rigortype 0.4.3 → 0.4.5

data/lib/rigor/analysis/rule_catalog.rb

@@ -94,7 +94,17 @@ module Rigor
           does_not_fire_when: [
             "Implicit-self calls (no receiver) — too noisy without per-method RBS for every helper.",
             "Receiver is `Dynamic[T]` / `Top` / `Union` — by definition the method set isn't enumerable.",
-            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases)."
+            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases).",
+            "Receiver class answers beyond any signature: a plugin-declared open receiver (ADR-26), or one " \
+            "Rigor's bundled overlays name (`OpenStruct`, whose fields are per-instance singleton methods; " \
+            "`ActiveSupport::Duration` and `ActiveSupport::Concern` when their gem overlay loads). Both sides " \
+            "of the class are open, and an inherited Object / Kernel signature no longer decides " \
+            "`call.wrong-arity` or `call.argument-type-mismatch` on it.",
+            "The program may answer the call another way (#1722): a `method_missing` on the receiver's class or an " \
+            "ancestor; a module mixed into either that defines the method (`Integer.include(Ext)` counts wherever " \
+            "it is written); singleton methods given to the receiver local (`s.extend(M)`, " \
+            "`define_singleton_method`, `class << s`); or, for a receiver typed by its class's name rather than a " \
+            "literal, a project subclass that defines the method."
           ],
           suppression: "`# rigor:disable call.undefined-method` on the call line, " \
                        "or `disable: [\"call.undefined-method\"]` in `.rigor.yml`.",
@@ -556,14 +566,22 @@ module Rigor
           summary: "Explicit-receiver call to a method declared `private` in source.",
           fires_when: [
             "Call is `receiver.method(...)` with explicit non-self receiver.",
-            "Receiver type resolves to `Type::Nominal[X]`.",
-            "X is a user-defined class whose source carries the method under `private`."
+            "Receiver type resolves to `Type::Nominal[X]`, or to the class object `singleton(X)`.",
+            "X is a user-defined class whose source carries the method under `private`; for a class object, " \
+            "the singleton method the call reaches is private (`private_class_method`, `class << self` with " \
+            "`private`, or a private method of a module X extends)."
           ],
           does_not_fire_when: [
             "Implicit-self call (no receiver) — always allowed for private.",
             "Receiver is `self` (Ruby 2.7+ permits `self.private_method`).",
             "Receiver class is RBS-known but not user-source-defined (RBS-side visibility is deferred).",
-            "Method is `:protected` (subclass tracking is deferred)."
+            "Method is `:protected` (subclass tracking is deferred).",
+            "A `method_missing` or `respond_to_missing?` on the receiver's chain, on the side the call reaches, " \
+            "may answer the call (Ruby sends a private call to `method_missing`).",
+            "The visibility rests on a statement that may not run, or on files that disagree about it.",
+            "On a class object: the receiver is not a constant (`self.class.x` may be a subclass that " \
+            "re-publicises the name), or the call is not inside a `def` (load-time code may run before the " \
+            "method is made private)."
           ],
           suppression: "`# rigor:disable method-visibility-mismatch`.",
           severity_authored: :error,

data/lib/rigor/analysis/run_cache_key.rb

@@ -70,13 +70,14 @@ module Rigor
       RUN_EFFECTS_TABLE_PRODUCER_ID = "analysis.run-effects-table"
 
       # The run-result producer's declared compaction budget (`Cache::Store#evict!` pass 2). Whole-project,
-      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` key slot means
-      # one entry per analyzed-path SET, so `rigor check` over the whole project, over `lib`, and over a
-      # single file are three separate live generations. 16 is a judgement call sized for that churn; it is
-      # a cap on GENERATIONS, not on correctness — over-evicting here costs a recompute, never a wrong
-      # answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap does bind (60 distinct
-      # path-set generations observed, differing in the `paths` slot alone), with no evidence yet on how
-      # often an evicted generation is asked for again — see issue #151.
+      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` and `roots` key
+      # slots mean one entry per analyzed-path SET x root list as written (#1559), so `rigor check` over the
+      # whole project, over `lib`, and over a single file are three separate live generations, and `rigor
+      # check` and `rigor check lib` are two even when `lib` is the configured `paths:`. 16 is a judgement call
+      # sized for that churn; it is a cap on GENERATIONS, not on correctness — over-evicting here costs a
+      # recompute, never a wrong answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap
+      # does bind (60 distinct path-set generations observed, differing in the `paths` slot alone), with no
+      # evidence yet on how often an evicted generation is asked for again — see issue #151.
       GENERATION_CAP = 16
 
       # The effects sidecar's own compaction budget. One generation per (path set × effects identity), and
@@ -109,6 +110,29 @@ module Rigor
         nil
       end
 
+      # #1559 — the run-result key's analysis ROOTS, as the run was given them. The `paths` slot holds only the
+      # files the roots expand to, so `check lib extra` with `extra` missing and `check lib` shared a key while
+      # only the first prints `extra:1:1: warning: no such file or directory (skipped)`, which changes the exit
+      # code under `--fail-on=warning`. The roots are kept in the order and spelling written, not normalised: a
+      # missing root is reported as written (`./extra` is not `extra`), and the order of the roots is the order
+      # the diagnostics come out in, so two runs that differ only in either are two slots (a forgone hit, never a
+      # wrong one).
+      #
+      # Added to the DIAGNOSTICS key only. The ADR-103 effects sidecar derives its identity from {#descriptor}
+      # without it: the effect table is a function of the analysed files, and no path-error row reaches it.
+      # The `--incremental` slot builds its own, normalised, roots entry ({IncrementalRunSlot}).
+      #
+      # @param descriptor — a {#descriptor} result (nil passes through, so a disabled cache stays disabled).
+      def with_roots(descriptor, roots)
+        return nil if descriptor.nil?
+
+        entry = config_entry("roots", Marshal.dump(Array(roots).map(&:to_s)))
+        Cache::Descriptor.new(
+          gems: descriptor.gems, dependencies: descriptor.dependencies, plugins: descriptor.plugins,
+          configs: descriptor.configs + [entry]
+        )
+      end
+
       # Issue #285 — the `engine` slot above pins the engine by VERSION, which identifies the source only
       # for a released gem. A checkout (a contributor's, or a `bundle add rigor, github:` clone) gets one
       # extra slot carrying a digest of the engine's own source, so editing `lib/rigor/inference/*.rb` no

data/lib/rigor/analysis/run_cache_probe.rb

@@ -65,9 +65,11 @@ module Rigor
       #   probe must never turn a servable run into a crash.
       def serve(paths)
         files = PathExpansion.ruby_files(paths, @configuration.exclude_patterns, base: @configuration.exclude_base)
-        key = RunCacheKey.descriptor(
-          configuration: @configuration, files: files, explain: @explain,
-          rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+        key = RunCacheKey.with_roots(
+          RunCacheKey.descriptor(
+            configuration: @configuration, files: files, explain: @explain,
+            rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+          ), paths
         )
         return nil if key.nil?
 

data/lib/rigor/analysis/runner/diagnostic_aggregator.rb

@@ -57,7 +57,8 @@ module Rigor
                        quarantined_signatures_snapshot:, env_build_failure_snapshot:,
                        definition_build_failures_snapshot:, hkt_scan_failure_snapshot:,
                        conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] },
-                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] })
+                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] },
+                       pooled_trust_refusals: -> { [] })
           @configuration = configuration
           @rbs_extended_reporter = rbs_extended_reporter
           @boundary_cross_reporter = boundary_cross_reporter
@@ -78,6 +79,9 @@ module Rigor
           # Issue #1051 — reader for the pool coordinator's de-duplicated run-scoped disclosure table.
           # Empty on a sequential run, where `plugin_registry`'s own instances are the ones that registered.
           @pooled_run_disclosures_reader = pooled_run_disclosures
+          # Issue #1900 — reader for the pool coordinator's summed trust-refusal table. Empty on a
+          # sequential run, where `plugin_registry`'s own boundaries made every read.
+          @pooled_trust_refusals_reader = pooled_trust_refusals
         end
 
         # Pre-file diagnostic streams that fire once per run rather than per analyzed file: plugin load /
@@ -613,9 +617,18 @@ module Rigor
         # culprit and reads the same on a cache hit, where every `RBS::Location` has been dumped to a
         # sentinel. The error class is attributed to that first failure explicitly rather than to all of
         # them: the per-class memo keeps only the first reason, and one run can mix error classes.
+        #
+        # Issue #1902 — "first" is first by CLASS NAME, not first recorded. The snapshot arrives in demand
+        # order, and that order is a property of the invocation, not of the project: an `--incremental`
+        # recheck records the classes its closure demanded before it unions in the replayed set, and a worker
+        # pool unions per-worker lists in drain order. So the classes are sorted by name and the files
+        # sorted and deduplicated here. Which tuple each class carries is fixed upstream
+        # ({Environment::RbsLoader.definition_build_detail_order}), not here.
         def build_rbs_definition_build_failed_diagnostic(failures)
+          failures = failures.sort_by { |failure| failure.first.to_s }
           sample_size = 5
-          files = failures.flat_map { |failure| Array(failure[3]) }.uniq.map { |name| relative_signature_path(name) }
+          files = failures.flat_map { |failure| Array(failure[3]) }
+                          .map { |name| relative_signature_path(name) }.uniq.sort
           Diagnostic.new(
             path: ".rigor.yml",
             line: 1,
@@ -1084,16 +1097,22 @@ module Rigor
         # cache"). It is also never routed through `IncrementalSession`'s per-file cache (`#788`): that cache
         # holds only `Runner#per_file_diagnostics`, and this row is not part of that stream.
         #
-        # Scope: `plugin_registry` here is the coordinator-side registry, which only actually RUNS `#prepare`
-        # / per-file analysis in sequential mode (`--workers` unset, the default) — a pooled run (`--workers
-        # N`) prepares and analyses on per-worker `WorkerSession` registries this reader never sees, so a
-        # refusal confined to a pooled worker's slice is not reported. Left out deliberately: draining it
-        # needs a fourth marshalled channel beside `drain_reporters` / `drain_dependencies` / `drain_effects`
-        # in `Runner::PoolCoordinator`, and the default (unpooled) path already covers the reported bug.
+        # Two sources (issue #1900), summed per plugin: the coordinator-side registry's own boundaries — where
+        # a sequential run, and the pool's no-worker fallback, made every read — and `pooled_trust_refusals`,
+        # what a pooled run drained from its pre-fork parent session and every worker
+        # ({Runner::PoolCoordinator#merge_trust_refusals}). The count is per refused ATTEMPT, as
+        # `--workers 0` always counted it; the pool drains the parent's `#prepare` refusals before forking and
+        # each worker reports only what it added, so the workers, which inherit the parent's boundaries, do
+        # not count them again. Rows follow registry
+        # (plugin load) order, which every mode shares.
         def plugin_trust_refusal_diagnostics
           return [] if plugin_registry.empty?
 
-          plugin_registry.plugins.filter_map { |plugin| plugin_trust_refusal_diagnostic(plugin) }
+          pooled = Array(pooled_trust_refusals).to_h { |record| [record[:plugin_id], record] }
+          plugin_registry.plugins.filter_map do |plugin|
+            summary = combined_refusal_summary(pooled[disclosure_plugin_id(plugin)], plugin)
+            plugin_trust_refusal_diagnostic(plugin, summary) if summary
+          end
         end
 
         # Issue #1051 — the run-scoped plugin disclosures ({Plugin::Base#disclose_once}), the run's
@@ -1193,10 +1212,23 @@ module Rigor
           plugin.class.to_s
         end
 
-        def plugin_trust_refusal_diagnostic(plugin)
-          summary = plugin.io_boundary.refusal_summary
-          return nil if summary.nil?
+        # The coordinator's own record first when it has one: on a pooled run it holds the `#init` reads
+        # (every registry runs `#init`; the workers' drains start after it), which `--workers 0` makes before
+        # `#prepare` and before any file, so its first path is the one a sequential run names. Not so after a
+        # Ractor-backend degrade, where this record also holds the re-analysed files' refusals and is named
+        # ahead of a worker's `#prepare` path; the count is right either way.
+        def combined_refusal_summary(pooled, plugin)
+          local = begin
+            plugin.io_boundary.refusal_summary
+          rescue StandardError
+            nil
+          end
+          return local || pooled if pooled.nil? || local.nil?
+
+          local.merge(count: local[:count] + pooled[:count])
+        end
 
+        def plugin_trust_refusal_diagnostic(plugin, summary)
           plugin_id = plugin.manifest.id
           Diagnostic.new(
             path: ".rigor.yml", line: 1, column: 1,
@@ -1283,6 +1315,10 @@ module Rigor
           @pooled_run_disclosures_reader.call
         end
 
+        def pooled_trust_refusals
+          @pooled_trust_refusals_reader.call
+        end
+
         def pre_eval_diagnostics_from_scanner
           @pre_eval_diagnostics_from_scanner_reader.call
         end