rigortype 0.3.8 → 0.4.0

data/lib/rigor/analysis/check_rules/lexical_method_sites.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../inference/scope_indexer"
+require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Issue #1120 — the two ways one file makes a method callable at some sites and not at others, which
+      # `call.undefined-method` has to ask the file's syntax about because no project-wide table can answer:
+      #
+      # - **Refinements.** `using M` activates M's refinements from the end of the call to the end of the body
+      #   that holds it — the file's top level or a `class` / `module` body, including everything nested in it —
+      #   and nowhere else, not even in another file. A `refine X do … end` block is active inside itself. What
+      #   each module refines is the project-wide `Scope#discovered_refinements`; this answers whether any of
+      #   those modules is in effect at a call site. A `using` whose argument is not a constant
+      #   (`using Module.new { refine … }`) names no module, so every refinement counts as in effect throughout
+      #   its file. A `using` inside a `def` raises in Ruby and activates nothing.
+      # - **Singleton defs on locals.** `def o.m` defines `m` on the one object `o` holds. The local's type
+      #   is not changed; `o.m` is simply not reported within the scope the `def` is written in (the
+      #   enclosing `def`, `class` / `module` body, or file — a block shares its enclosing scope's locals).
+      #
+      # Built lazily: the walk runs the first time a would-fire call asks, so a file with no such call pays
+      # one small object and nothing else.
+      class LexicalMethodSites
+        def initialize(root)
+          @root = root
+          @built = false
+        end
+
+        # Is a refinement from one of `modules` (refining-module names) in effect at `call_node`?
+        def refinement_active?(call_node, modules)
+          build
+          return true if @unresolved_using
+
+          offset = call_node.location.start_offset
+          return true if @refine_blocks.any? { |start, stop| offset >= start && offset < stop }
+
+          @usings.any? do |start, stop, candidates|
+            offset >= start && offset < stop && candidates.any? { |name| modules.include?(name) }
+          end
+        end
+
+        # Issue #1367 — is any refinement in effect at `node`: a `using` of any module, a `using` of a non-constant, or
+        # the inside of a `refine` block? The `global.*` stream check asks it where it cannot name the refining
+        # module (a `define_method` or `alias_method` inside `refine` records none).
+        def using_in_effect?(node)
+          build
+          return true if @unresolved_using
+
+          offset = node.location.start_offset
+          @refine_blocks.any? { |start, stop| offset >= start && offset < stop } ||
+            @usings.any? { |start, stop, _candidates| offset >= start && offset < stop }
+        end
+
+        # Is `def_node` one of the defs a `refine X do … end` body defines on X? Such a def redefines X's method by
+        # design, so X's declared signature for the name is not its contract (issue #1120, maintainer ruling a′).
+        def refinement_def?(def_node)
+          build
+          @refinement_defs.include?(def_node.location.start_offset)
+        end
+
+        # Does a `def <local>.<name>` for this call's local receiver and method name sit in the scope the call
+        # is in?
+        def singleton_local_def?(call_node)
+          receiver = call_node.receiver
+          return false unless receiver.is_a?(Prism::LocalVariableReadNode)
+
+          build
+          offset = call_node.location.start_offset
+          @singleton_defs.any? do |local, method_name, start, stop|
+            local == receiver.name && method_name == call_node.name && offset >= start && offset < stop &&
+              !nested_scope_holds?(offset, start, stop)
+          end
+        end
+
+        private
+
+        # Is `offset` inside a local scope nested in the one `[start, stop)` spans? A `def` in the file's top level
+        # does not see the top level's `o`.
+        def nested_scope_holds?(offset, start, stop)
+          @scopes.any? do |inner_start, inner_stop|
+            (inner_start > start || inner_stop < stop) && inner_start >= start && inner_stop <= stop &&
+              offset >= inner_start && offset < inner_stop
+          end
+        end
+
+        def build
+          return if @built
+
+          @built = true
+          @usings = []
+          @refine_blocks = []
+          @singleton_defs = []
+          @scopes = []
+          @refinement_defs = Set.new
+          @unresolved_using = false
+          return if @root.nil?
+
+          location = @root.location
+          span = [location.start_offset, location.end_offset]
+          walk(@root, [], span, span, false)
+        end
+
+        # `body` is the `[start, end]` of the body a `using` here stays in effect to the end of; `locals` is the
+        # span of the scope a local written here belongs to.
+        def walk(node, prefix, body, locals, in_def)
+          case node
+          when Prism::ClassNode, Prism::ModuleNode
+            span = scope_span(node)
+            inner = Source::ConstantPath.declaration_prefix(prefix, node.constant_path) || prefix
+            return walk_children(node.body, inner, span, span, false)
+          when Prism::SingletonClassNode
+            walk(node.expression, prefix, body, locals, in_def)
+            span = scope_span(node)
+            return walk_children(node.body, prefix, span, span, false)
+          when Prism::DefNode
+            record_singleton_def(node, locals)
+            return walk_children(node.body, prefix, body, scope_span(node), true)
+          when Prism::CallNode
+            record_call(node, prefix, body, in_def)
+          end
+
+          walk_children(node, prefix, body, locals, in_def)
+        end
+
+        def walk_children(node, prefix, body, locals, in_def)
+          return if node.nil?
+
+          node.rigor_each_child { |child| walk(child, prefix, body, locals, in_def) }
+        end
+
+        def record_singleton_def(node, locals)
+          receiver = node.receiver
+          return unless receiver.is_a?(Prism::LocalVariableReadNode)
+
+          @singleton_defs << [receiver.name, node.name, *locals]
+        end
+
+        def record_call(node, prefix, body, in_def)
+          if Inference::ScopeIndexer.refine_target(node)
+            @refine_blocks << span_of(node.block)
+            record_refinement_defs(node.block.body)
+          elsif using_call?(node) && !in_def
+            record_using(node, prefix, body)
+          end
+        end
+
+        def record_refinement_defs(body)
+          return if body.nil?
+
+          Inference::ScopeIndexer.each_refinement_def(body) do |def_node|
+            @refinement_defs << def_node.location.start_offset
+          end
+        end
+
+        def using_call?(node)
+          node.name == :using && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)) &&
+            node.arguments&.arguments&.size == 1
+        end
+
+        def record_using(node, prefix, body)
+          argument = node.arguments.arguments.first
+          if argument.is_a?(Prism::ConstantReadNode) || argument.is_a?(Prism::ConstantPathNode)
+            candidates = Inference::ScopeIndexer.constant_receiver_candidates(argument, prefix)
+            @usings << [node.location.end_offset, body.last, candidates]
+          else
+            @unresolved_using = true
+          end
+        end
+
+        # The span of a node that opens a local scope, recorded for {#nested_scope_holds?}.
+        def scope_span(node)
+          span = span_of(node)
+          @scopes << span
+          span
+        end
+
+        def span_of(node)
+          location = node.location
+          [location.start_offset, location.end_offset]
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/main_pass_collector.rb

@@ -19,13 +19,15 @@ module Rigor
       # accumulated {Diagnostic}s, in the same emission order the inline `NodeWalker.each` produced them (the
       # shared walk is the same visit-before-descend DFS over `compact_child_nodes`).
       class MainPassCollector
-        # The node classes the former inline pass branched on. A plain `Prism::IfNode` covers ternaries and
-        # postfix `if` too (the legacy `when Prism::IfNode, Prism::UnlessNode` arm did the same).
+        # The node classes the main pass branches on. A plain `Prism::IfNode` covers ternaries and postfix `if`
+        # too (the legacy `when Prism::IfNode, Prism::UnlessNode` arm did the same). The three global-write
+        # classes carry issue #1367's `global.*` rules.
         NODE_CLASSES = [
-          Prism::CallNode, Prism::DefNode, Prism::IfNode, Prism::UnlessNode
+          Prism::CallNode, Prism::DefNode, Prism::IfNode, Prism::UnlessNode,
+          Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode
         ].freeze
 
-        # @param node_diagnostics [#call] maps a `Prism::Node` to the array of diagnostics the main pass emits
+        # @param node_diagnostics — maps a `Prism::Node` to the array of diagnostics the main pass emits
         #   for it.
         def initialize(node_diagnostics)
           @node_diagnostics = node_diagnostics

data/lib/rigor/analysis/check_rules/published_constant_guard.rb

@@ -50,11 +50,18 @@ module Rigor
       #   passage is the precedent for stopping at one hop rather than building a provenance channel through
       #   the return memo.
       #
-      # Deliberately NOT covered, and a separate change: a value copied into a local (`m = MODE; m == :x`),
-      # into an ivar (`@mode = MODE` in `initialize`), or through a same-file constant alias
-      # (`MODE2 = AppConfig::MODE`). Each needs flow provenance — ADR-58's `r = @x` stamping is the shape —
-      # rather than a syntactic root walk, and approximating it here is exactly the ad-hoc widening ADR-58's
-      # *Non-transitivity* passage forbids. Two hops (`live? -> prod? -> MODE`) also stay uncovered.
+      # - a value COPIED out of such a constant before the predicate reads it (issue #667) — into a local
+      #   (`m = AppConfig::MODE; m == :x`), into an ivar (`@mode = AppConfig::MODE` in `initialize`), or
+      #   through a same-file alias (`MODE2 = AppConfig::MODE`). A copy has no spelling for the root walk to
+      #   recognise, so the provenance is stamped on the value where the copy happens and travels with it:
+      #   the first two on the `Scope` flow carrier `published_constant_sourced` (dropped by any rebinding,
+      #   unioned at a join), the alias on the per-file `published_constant_alias_names` census table, which
+      #   needs no flow machinery at all because a constant write is not flow. This walk only READS those
+      #   marks — the widening ADR-58's *Non-transitivity* passage forbids is inferring one AT a consumer,
+      #   and the establishing transitions are named in
+      #   `docs/internal-spec/inference-engine.md` § "The truthiness withholding".
+      #
+      # Deliberately NOT covered: two interprocedural hops (`live? -> prod? -> MODE`).
       module PublishedConstantGuard
         # A defensive depth cap against a pathological chain (the walk is otherwise linear in chain length).
         MAX_DEPTH = 64
@@ -66,13 +73,15 @@ module Rigor
 
         module_function
 
-        # @return [Boolean] true when the rule MUST withhold its firing.
+        # @return true when the rule MUST withhold its firing.
         def rooted?(node, scope, depth = 0)
           return false if node.nil? || depth > MAX_DEPTH || scope.nil?
 
           case node
           when Prism::ConstantReadNode then scope.published_constant?(node.name.to_s)
           when Prism::ConstantPathNode then published_path?(node, scope)
+          when Prism::LocalVariableReadNode then scope.published_constant_sourced?(:local, node.name)
+          when Prism::InstanceVariableReadNode then scope.published_constant_sourced?(:ivar, node.name)
           when Prism::CallNode then rooted_call?(node, scope, depth)
           else rooted_through_composition?(node, scope, depth)
           end

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -6,9 +6,9 @@ module Rigor
       # Canonical identifiers for each rule. Per ADR-8 § "Diagnostic ID family hierarchy", rule names are
       # `family.rule-name` two-segment strings; the families group diagnostics by where they originate
       # (`call.*` for call-site rules, `flow.*` for flow-analysis proofs, `assert.*` for runtime-assertion
-      # rules, `dump.*` for debug helpers, `def.*` for method-definition rules). Used by the configuration
-      # `disable:` list and the in-source `# rigor:disable <rule>` suppression comment system; new rules MUST
-      # register here so user configuration can refer to them.
+      # rules, `dump.*` for debug helpers, `def.*` for method-definition rules, `global.*` for writes to special
+      # globals). Used by the configuration `disable:` list and the in-source `# rigor:disable <rule>`
+      # suppression comment system; new rules MUST register here so user configuration can refer to them.
       #
       # ADR-87 WD4 — this pure-data constant table is split out of the (engine-heavy) `check_rules.rb` so
       # {Analysis::RuleCatalog} — which the CLI's JSON `evidence_tier` / `documentation_url` enrichment reads
@@ -66,6 +66,18 @@ module Rigor
       # annotation must never turn collection on by itself (that would be a project-wide cost cliff
       # nobody asked for), and it must equally never be silently inert.
       RULE_EFFECT_ANNOTATIONS_UNCHECKED = "effect.annotations-unchecked"
+      # ADR-112 WD5 / #1075 — two statements of one member's contract that contradict: a `sig/` declaration
+      # against an inline `@rbs` / `#:` one (and, once #1073 reads it, `@rbs` / `#:` against `@extrbs`), or a
+      # `rigor:v1:` refinement outside the member's own declared type. `rbs.` because the finding is about
+      # the RBS the environment is built from, whichever file spelled it; not `rbs_extended.`, whose rows
+      # are payload validity, since most contradictions involve no `RBS::Extended` annotation at all.
+      RULE_CONTRADICTING_SIGNATURE = "rbs.contradicting-signature"
+      # Issue #1367 (ADR-117 WD2) — the `global.*` family: a write to a special global that its setter rejects, so
+      # the write raises on every run. Two ids so a project can tune the type check without hiding read-only
+      # writes; the `write` wording follows `def.ivar-write-mismatch`. The envelope is the interpreter's setter
+      # (`SpecialGlobalSetters`), not the global's RBS declaration.
+      RULE_GLOBAL_WRITE_TYPE_MISMATCH = "global.write-type-mismatch"
+      RULE_GLOBAL_READONLY_WRITE = "global.readonly-write"
 
       ALL_RULES = [
         RULE_UNDEFINED_METHOD,
@@ -91,6 +103,8 @@ module Rigor
         RULE_OVERRIDE_RETURN_WIDENED,
         RULE_OVERRIDE_PARAM_NARROWED,
         RULE_IVAR_WRITE_MISMATCH,
+        RULE_GLOBAL_WRITE_TYPE_MISMATCH,
+        RULE_GLOBAL_READONLY_WRITE,
         RULE_SUPPRESSION_UNKNOWN_RULE,
         RULE_SUPPRESSION_EMPTY,
         RULE_SUPPRESSION_UNKNOWN_MARKER,
@@ -98,7 +112,8 @@ module Rigor
         RULE_EFFECT_ENVELOPE_EXCEEDED,
         RULE_EFFECT_LISKOV_WIDENED,
         RULE_EFFECT_UNKNOWN_LABEL,
-        RULE_EFFECT_ANNOTATIONS_UNCHECKED
+        RULE_EFFECT_ANNOTATIONS_UNCHECKED,
+        RULE_CONTRADICTING_SIGNATURE
       ].freeze
 
       # Backward-compat alias table (ADR-8 § "Backward compatibility"). Existing user code with
@@ -128,7 +143,7 @@ module Rigor
 
       # Family wildcard — a `<family>` token in a suppression comment or `disable:` list disables every rule
       # whose canonical id starts with `<family>.`. Per ADR-8 § "1".
-      RULE_FAMILIES = %w[call flow assert dump def suppression static effect].freeze
+      RULE_FAMILIES = %w[call flow assert dump def global suppression static effect].freeze
 
       # Families of diagnostics the engine emits OUTSIDE the CheckRules catalogue (aggregator-level and
       # reporter-level diagnostics such as `rbs_extended.unsatisfied-conformance`,
@@ -137,7 +152,7 @@ module Rigor
       # first segment appears here as KNOWN and stays silent: these ids are legitimate suppression /
       # `severity_overrides:` vocabulary the light rule-id table cannot enumerate (plugins load dynamically;
       # aggregator ids live in the engine-heavy runner), so under-warning is the FP-safe direction.
-      NON_CHECK_DIAGNOSTIC_FAMILIES = %w[rbs_extended dynamic rbs pre-eval plugin].freeze
+      NON_CHECK_DIAGNOSTIC_FAMILIES = %w[rbs_extended dynamic rbs pre-eval plugin plugin_trust].freeze
 
       # Bare (dot-less) diagnostic ids the engine emits outside the catalogue (see the `rule:` literals in
       # `Analysis::Runner` / `Runner::DiagnosticAggregator`). A token equal to one of these is treated as

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -40,11 +40,27 @@ module Rigor
 
         CLASS_OR_MODULE_NODE_CLASSES = [Prism::ClassNode, Prism::ModuleNode].freeze
 
+        # Issue #909 — the receivers whose block form opens a class body that is NOT the lexically enclosing
+        # class: `Class.new do … end`, `Module.new`, `Struct.new`, `Data.define`. A `def` in such a block
+        # belongs to the anonymous class the call returns, so its ivar writes are a different store from the
+        # enclosing class's.
+        DETACHED_CLASS_FACTORIES = {
+          Class: %i[new],
+          Module: %i[new],
+          Struct: %i[new],
+          Data: %i[define]
+        }.freeze
+        Ractor.make_shareable(DETACHED_CLASS_FACTORIES)
+        private_constant :DETACHED_CLASS_FACTORIES
+
+        EMPTY_METHODS = [].freeze
+        private_constant :EMPTY_METHODS
+
         # The immutable per-node descent context. Recomputed for each child from its parent's context as the
         # walk descends; collectors read only the fields they declared a need for.
-        Context = Data.define(:in_loop_or_block, :qualified_prefix, :inside_def) do
+        Context = Data.define(:in_loop_or_block, :qualified_prefix, :inside_def, :detached_ivar_facet) do
           def self.root
-            new(in_loop_or_block: false, qualified_prefix: [], inside_def: false)
+            new(in_loop_or_block: false, qualified_prefix: [], inside_def: false, detached_ivar_facet: false)
           end
         end
 
@@ -58,9 +74,13 @@ module Rigor
         # - `:inside_def` (`inside_def`) — lexically inside a `DefNode`; IvarWrite collects only at a `def`
         #   that sits directly in a class / module body (its legacy walk `return`s at the first `def` it
         #   meets, so a nested def is never reached).
+        # - `:detached_ivar_facet` (`detached_ivar_facet`) — under a `class << self` body or an
+        #   anonymous-class factory block, where the enclosing class name does not name the ivar store the
+        #   body writes to.
         GATE_CONTEXT_PREDICATES = {
           loop_or_block: :in_loop_or_block,
-          inside_def: :inside_def
+          inside_def: :inside_def,
+          detached_ivar_facet: :detached_ivar_facet
         }.freeze
 
         # A per-node driver over a fixed collector set: holds the compiled `node_class => [[collector,
@@ -89,7 +109,7 @@ module Rigor
             end
           end
 
-          # The context the children of `node` descend under. Mirrors {RuleWalk.descend}.
+          # Mirrors {RuleWalk.descend}.
           def descend(node, context)
             RuleWalk.descend(node, context)
           end
@@ -124,14 +144,30 @@ module Rigor
                                LOOP_OR_BLOCK_NODE_CLASSES.any? { |klass| node.is_a?(klass) }
             inside_def = context.inside_def || node.is_a?(Prism::DefNode)
             qualified_prefix = extend_prefix(node, context.qualified_prefix)
+            detached_ivar_facet = context.detached_ivar_facet || detached_ivar_facet?(node)
 
             Context.new(
               in_loop_or_block: in_loop_or_block,
               qualified_prefix: qualified_prefix,
-              inside_def: inside_def
+              inside_def: inside_def,
+              detached_ivar_facet: detached_ivar_facet
             )
           end
 
+          # True for a node whose descendants write ivars to a store the enclosing class name does not name:
+          # a `class << self` body (the class object's own ivars) or a call that builds an anonymous class
+          # from a block. Every singleton-class body counts, `class << Konstant` included: whichever object's
+          # singleton it opens, it is not the instance facet the enclosing prefix names.
+          def detached_ivar_facet?(node)
+            return true if node.is_a?(Prism::SingletonClassNode)
+            return false unless node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode)
+
+            receiver = node.receiver
+            return false unless receiver.is_a?(Prism::ConstantReadNode)
+
+            DETACHED_CLASS_FACTORIES.fetch(receiver.name, EMPTY_METHODS).include?(node.name)
+          end
+
           private
 
           def collector_gates(collector)

data/lib/rigor/analysis/check_rules/self_closedness_scanner.rb

@@ -29,7 +29,7 @@ module Rigor
           @root = root
         end
 
-        # @return [Set<String>] qualified names to exclude from the rule.
+        # @return qualified names to exclude from the rule.
         def open_class_names
           names = Set.new
           walk(@root, [], names)

data/lib/rigor/analysis/check_rules/shadowed_rescue_collector.rb

@@ -58,7 +58,7 @@ module Rigor
         # Legacy single-collector walk — the oracle the shadow harness (`RIGOR_SHADOW_RULE_WALK=1`) compares
         # the shared {RuleWalk} traversal against. Tracks the lexical class / module prefix itself, exactly
         # as {RuleWalk} threads `qualified_prefix`.
-        # @return [Array<Result>] one entry per provably-shadowed rescue clause.
+        # @return one entry per provably-shadowed rescue clause.
         def collect(root)
           walk(root, [])
           @results.freeze