rigortype 0.2.6 → 0.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97d286eb15708fc212260925d407b48926a331798f0d2f210321b1d3c66cda55
-  data.tar.gz: 9fadaf2c31394c142dd15b335dbf740774ceabff8ce85b8a79fcd7faa26ea4fa
+  metadata.gz: c16266bcbae2ff766dd6579df68ca08d31563d7f9a813ef49b88bd8f72734b7a
+  data.tar.gz: c80a5f751c3f757c30acfa0fd1631918a5b3fdc388752c03f27ad56c11a723c2
 SHA512:
-  metadata.gz: 1b800eb64d10fdef9039ed429f5740f672cdf0811de86c1cac1434b6bb5a0c820df68d8d8b01aa03ed0cab518d18a6e51af12d608cf6ad50556e4b653a4d3ed6
-  data.tar.gz: 5bee1c072412f7eac14d0c96314f8efe2473cd46efe9763e238bd3c345605deb29055db3601c52909c430d419d8821fc7befb51fe0f5211b8fbb94e379a5d635
+  metadata.gz: deda828a4f7171b30c1e0b0531fbb52cb815905e05ebb05186a87b49107d7ce9e80c4d5d9dc81fd35ed26a1872d2d6e9bbeefe98e3b146d1acd1e4d360a81a26
+  data.tar.gz: fbe3ba7eed33351ea7ec8863f09085ed1b55f99e17ac3a0bba51234723da1a35f1e90fa9dd694aa0a680c5dbb8725855deb789728c6886c16ccc229a6d4b1be1

data/README.md

@@ -231,9 +231,10 @@ rigor docs --list                 # list every bundled page
 
 ## Status
 
-Current release: **`v0.2.0`** (2026-06-17) — the first
-publicly-announced (general / evaluation) release. It publishes an
-enumerated [compatibility surface](docs/compatibility.md) as a
+Current release: **`v0.2.7`** (2026-07-05) — the latest cut on the
+`0.2.x` evaluation line opened by `v0.2.0`, the first
+publicly-announced (general / evaluation) release. The line publishes
+an enumerated [compatibility surface](docs/compatibility.md) as a
 minor-non-break trial, rehearsing the contract that hard-freezes at
 `v1.0.0`. Rigor analyses real Ruby today: it has been hardened against
 Mastodon, Redmine, and GitLab FOSS, and the deliberately conservative

data/docs/manual/02-cli-reference.md

@@ -452,13 +452,14 @@ The positional slot is a skill *name*; alternative outputs are flags,
 so a skill can never be shadowed by a verb.
 
 ```sh
-rigor skill [<name>] [--path <name>] [--list] [--describe]
+rigor skill [<name>] [--full <name>] [--path <name>] [--list] [--describe]
 ```
 
 | Form | Purpose |
 | --- | --- |
 | (none) / `--list` | Table of every bundled skill (name + absolute path). |
 | `<name>` | Print the `SKILL.md` body to stdout, with a header pointing at the skill's `references/` directory. |
+| `--full <name>` | Print the `SKILL.md` body **followed by every `references/*.md` inline** — the complete, version-current procedure in one call. This is what a skill's "First: load the version-current copy" directive points at, so a copy vendored into a project (e.g. via `npx skills add`) re-fetches its current steps from the installed gem instead of following a frozen copy. |
 | `--path <name>` | Print the single-line absolute `SKILL.md` path, suitable as input to a file-reading tool. |
 | `--describe` | Probe the project's state (config / baseline / `sig/` / CI — presence only, never runs `rigor check`) and recommend the next skill to run. Also spelled `describe`; surfaced top-level as [`rigor describe`](#rigor-describe) below. |
 

data/docs/manual/08-skills.md

@@ -108,6 +108,7 @@ source checkout. The `rigor skill` command surfaces them:
 rigor skill describe        # probe the project + recommend the next skill (alias: rigor describe)
 rigor skill --list          # name + absolute path for each bundled skill
 rigor skill <name>          # print the SKILL.md body (with a references/ header)
+rigor skill --full <name>   # the body + every references/*.md inline (complete procedure)
 rigor skill --path <name>   # one-line absolute SKILL.md path, for a file-reading tool
 ```
 
@@ -133,6 +134,26 @@ npx skills add rigortype/rigor
 (The contributor-only skills under `.claude/skills/` are marked internal
 and are not installed by a bulk `npx skills add`.)
 
+### Keeping installed skills current
+
+A skill copied into your project this way is **frozen at install time**,
+while Rigor keeps evolving — flags, config keys, and rule ids move release
+to release. To keep that from going stale (陳腐化), every skill opens with
+a **"First: load the version-current copy"** directive: before following
+its steps, an agent re-fetches the authoritative body from the *installed*
+Rigor with
+
+```sh
+rigor skill --full <name>   # the current body + all its references/, in one call
+```
+
+Because the vendored copy is fixed at install time but `rigor skill` always
+reads the gem, the two diverge as you upgrade, and the directive makes the
+agent prefer the gem's current version. You therefore do **not** need to
+re-install the skills after upgrading Rigor — only the thin entry point
+(`rigor-next-steps`) needs to work before Rigor exists; everything
+version-specific is served live by the installed binary.
+
 ## Running a skill
 
 In an agent that supports Agent Skills, invoke the skill by name (in

data/lib/rigor/cli/coverage_command.rb

@@ -144,7 +144,7 @@ module Rigor
 
       def scan_protection(paths, options)
         configuration = Configuration.load(options.fetch(:config))
-        environment = project_environment(configuration)
+        environment = plugin_aware_environment(configuration)
         scope = scope_with_inferred_params(paths, configuration, environment)
         scanner = Inference::ProtectionScanner.new(scope: scope)
         accumulator = ProtectionAccumulator.new
@@ -153,21 +153,38 @@ module Rigor
         accumulator.to_report
       end
 
-      # ADR-67 WD3 — seed the call-site parameter-inference table so the
-      # protection scan counts an inferred-parameter receiver (e.g. `node.loc`
-      # where `node` is a `def compile(node)` parameter) as protected when its
-      # call sites resolve to concrete argument types. ONLY the parameter table
-      # is seeded — no cross-file discovery — so every site that does not gain
-      # an inferred parameter type is classified byte-identically to the
-      # un-inferred baseline. Collection spans the scanned `paths`.
+      # Seed the protection scan's scope with the same cross-file facts
+      # `rigor check` resolves against, so a receiver reads the type it
+      # actually has rather than a stripped-scope `Dynamic`:
+      #
+      # - `discovered_classes` — a project constant referring to a class
+      #   defined in a *sibling* file (`Account`, `User`) types as
+      #   `singleton(Account)` instead of `Dynamic`. Without this, a
+      #   single-file scan cannot see a class it does not itself declare,
+      #   so every cross-file class-constant dispatch was miscounted as
+      #   unprotected (the model-constant undercount found 2026-07-04).
+      # - `param_inferred_types` (ADR-67 WD3) — an inferred-parameter
+      #   receiver (`node.loc` where `node` is a `def compile(node)`
+      #   parameter) counts as protected when its call sites resolve to
+      #   concrete argument types.
+      #
+      # Both span the scanned `paths` only (no whole-project pre-pass) —
+      # a site that gains neither is classified exactly as before.
       def scope_with_inferred_params(paths, configuration, environment)
         base = Scope.empty(environment: environment)
+        seed = {}
+
+        discovered = Inference::ScopeIndexer.discovered_classes_for_paths(paths)
+        seed[:discovered_classes] = discovered unless discovered.empty?
+
         table = Inference::ParameterInferenceCollector.collect(
           files: paths, environment: environment, target_ruby: configuration.target_ruby
         )
-        return base if table.empty?
+        seed[:param_inferred_types] = table unless table.empty?
+
+        return base if seed.empty?
 
-        base.with_discovery(base.discovery.with(param_inferred_types: table))
+        base.with_discovery(base.discovery.with(**seed))
       end
 
       def determine_protection_exit(report, options)
@@ -196,6 +213,21 @@ module Rigor
         CoverageScan.project_environment(configuration)
       end
 
+      # The protection scan must see the same receiver types `rigor check`
+      # does — including plugin-contributed `dynamic_return` types (a
+      # controller's `params` → `ActionController::Parameters`, a
+      # `Model.where` → `ActiveRecord::Relation[Model]`). The bare
+      # `project_environment` carries only the RBS environment (no plugin
+      # registry), so every plugin-typed receiver reads `Dynamic` and its
+      # dispatch site is miscounted as *unprotected* — a systematic
+      # undercount of what Rigor actually types on a plugin-using project.
+      # `ProjectContext` builds the plugin-aware environment (registry
+      # materialised + the per-run prepare pass that primes producers like
+      # the controller / model index) exactly as the LSP and the runner do.
+      def plugin_aware_environment(configuration)
+        LanguageServer::ProjectContext.new(configuration: configuration).environment
+      end
+
       def scan_one(path, scanner, accumulator, configuration)
         CoverageScan.scan_into(path, scanner, accumulator, configuration)
       end

data/lib/rigor/cli/skill_command.rb

@@ -25,6 +25,12 @@ module Rigor
     #                                inline body plus the header's absolute
     #                                paths let the agent act with or without
     #                                a file-reading tool.
+    # - `rigor skill --full <name>`— the body AND every `references/*.md`
+    #                                inline: the complete, version-current
+    #                                procedure in one call. The thinned SKILL
+    #                                bodies point a *frozen* (vendored) copy
+    #                                at this so the reader follows the gem's
+    #                                current steps, not a stale local copy.
     # - `rigor skill --path <name>`— one-line absolute path, for a Read tool.
     # - `rigor skill --list`       — table of name + absolute path.
     # - `rigor skill --describe`   — ADR-73's live entry point: a cheap
@@ -43,12 +49,14 @@ module Rigor
     # verb, so it stays first-class alongside `--describe`.
     class SkillCommand < Command
       USAGE = <<~USAGE
-        Usage: rigor skill [<name>] [--path <name>] [--list] [--describe]
+        Usage: rigor skill [<name>] [--full <name>] [--path <name>] [--list] [--describe]
 
         With no argument, lists the bundled skills.
 
           rigor skill                List bundled skills
           rigor skill <name>         Print the SKILL.md body for <name> (with a header)
+          rigor skill --full <name>  Print the SKILL.md body AND its references/ inline
+                                     (the complete, version-current procedure in one call)
           rigor skill --path <name>  Print the absolute path of the SKILL.md file for <name>
           rigor skill --list         List bundled skills (name + absolute path)
           rigor skill --describe     Report project state + recommend the next skill to run
@@ -56,6 +64,7 @@ module Rigor
         Examples:
           rigor skill
           rigor skill rigor-project-init
+          rigor skill --full rigor-baseline-reduce
           rigor skill --path rigor-baseline-reduce
           rigor skill --describe        (also: rigor describe)
 
@@ -95,6 +104,9 @@ module Rigor
         when "--list"
           @argv.shift
           run_list
+        when "--full"
+          @argv.shift
+          run_full(@argv.shift)
         when "--path"
           @argv.shift
           run_path(@argv.shift)
@@ -147,6 +159,34 @@ module Rigor
         0
       end
 
+      # `rigor skill --full <name>` — the whole current procedure in one
+      # call: the SKILL.md body followed by each `references/*.md` inline.
+      # This is what the thinned SKILL bodies point a *frozen* copy at — a
+      # vendored copy of a skill (installed via `npx skills`) may lag the
+      # gem, so re-fetching the complete body here guarantees the reader
+      # follows the version that shipped with the installed Rigor, without
+      # needing a file-reading tool or reading a possibly-stale co-located
+      # `references/`.
+      def run_full(name)
+        return usage_error("`--full` requires a skill name") if name.nil?
+
+        skill = find_skill(name)
+        return name_error(name) if skill.nil?
+
+        @out.puts(render_print_header(skill))
+        @out.puts
+        @out.write(File.read(skill.fetch(:path)))
+
+        reference_files(skill).each do |ref|
+          @out.puts
+          @out.puts
+          @out.puts("<!-- ===== references/#{File.basename(ref)} (bundled with rigortype #{Rigor::VERSION}) ===== -->")
+          @out.puts
+          @out.write(File.read(ref))
+        end
+        0
+      end
+
       def run_path(name)
         return usage_error("`--path` requires a skill name") if name.nil?
 
@@ -207,6 +247,17 @@ module Rigor
         discover_skills.find { |s| s.fetch(:name) == name }
       end
 
+      # The `references/*.md` files bundled alongside a skill, sorted so the
+      # `NN-` prefixes drive read order.
+      def reference_files(skill)
+        dir = File.join(File.dirname(skill.fetch(:path)), "references")
+        return [] unless File.directory?(dir)
+
+        # `Dir.glob` returns lexicographically sorted paths (Ruby 3.0+),
+        # so the `NN-` prefixes already drive read order.
+        Dir.glob(File.join(dir, "*.md"))
+      end
+
       def name_error(name)
         @err.puts("Unknown skill: #{name}")
         @err.puts("Available skills (try `rigor skill --list`):")

data/lib/rigor/environment/rbs_loader.rb

@@ -291,12 +291,29 @@ module Rigor
         # prefix of another name is declared `module` (it is a
         # namespace); a leaf is declared `class` (referenced types
         # appear in instance position far more often than as mixins).
+        #
+        # Names already declared in `base_env` are skipped — exactly the
+        # `declared.include?` guard {.collect_missing_namespaces} applies.
+        # Without it, stubbing a nested reference (`Foo::Bar::Baz`) re-emits
+        # its enclosing prefix (`Foo::Bar`) as a `module`, and when that
+        # prefix is already a `class` in the project's own `sig/` the kind
+        # mismatch makes `resolve_type_names` raise
+        # `RBS::DuplicatedDeclarationError`, collapsing the WHOLE env to nil
+        # (every type-of query then degrades to `Dynamic[Top]`). One
+        # malformed `.rbs` must not disproportionately blind the analysis:
+        # a subclass sig that references an inherited nested type
+        # (`class GitAdapter; def x: () -> GitAdapter::Revision`) was the
+        # real-world trigger — see the 2026-07-04 redmine onboarding note.
         def append_stub_declarations(base_env, missing)
+          declared = declared_type_names(base_env)
           names = missing.to_set
           missing.each do |name|
             parts = name.split("::")
             (1...parts.length).each { |i| names << parts[0, i].join("::") }
           end
+          names = names.reject { |name| declared.include?(name) }.to_set
+          return if names.empty?
+
           source = names.sort_by { |n| n.count(":") }.map do |name|
             keyword = names.any? { |other| other != name && other.start_with?("#{name}::") } ? "module" : "class"
             "#{keyword} #{name}\nend\n"
@@ -308,6 +325,17 @@ module Rigor
           nil
         end
 
+        # The `::`-stripped names of every class / module / class-alias
+        # declaration already present in `env`, so the synthesis paths
+        # never re-declare (and thereby duplicate) a real declaration.
+        def declared_type_names(env)
+          names = env.class_decls.keys.map { |n| n.to_s.sub(/\A::/, "") }
+          if env.respond_to?(:class_alias_decls)
+            names.concat(env.class_alias_decls.keys.map { |n| n.to_s.sub(/\A::/, "") })
+          end
+          names.to_set
+        end
+
         # ADR-32 WD4 — merge synthesised-from-source RBS strings
         # into the freshly-built environment. Each entry is a
         # `[virtual_filename, rbs_source]` pair. `virtual_filename`

data/lib/rigor/inference/statement_evaluator.rb

@@ -782,10 +782,6 @@ module Rigor
       # (the else runs only when no exception was raised), but the
       # body's scope effects still apply because the body did run
       # before the else.
-      def eval_begin_primary(node)
-        eval_begin_primary_under(node, scope)
-      end
-
       def eval_begin_primary_under(node, entry_scope)
         body_type, body_scope =
           if node.statements

data/lib/rigor/sig_gen/generator.rb

@@ -63,6 +63,7 @@ module Rigor
         @namespace_kinds = {}
         @module_function_methods = Set.new
         @class_shells = Set.new
+        @class_superclasses = {}
       end
 
       # Lifts legacy plain-`Array[Type]` observation entries
@@ -116,6 +117,7 @@ module Rigor
         @namespace_kinds = {}
         @module_function_methods = Set.new
         @class_shells = Set.new
+        @class_superclasses = {}
         defs = collect_method_definitions(parse_result.value)
         candidates_from_defs = defs.filter_map do |def_node, class_name, kind|
           # An analyzer bug typing one def's body must cost only that
@@ -195,10 +197,32 @@ module Rigor
 
         full = (prefix + [name]).join("::")
         @namespace_kinds[full] = node.is_a?(Prism::ClassNode) ? :class : :module
+        record_superclass(node, full)
         walk_namespace_body(node, prefix + [name], out)
         true
       end
 
+      # ADR-14: a generated subclass declaration MUST carry its
+      # superclass, or the sidecar `sig/` misrepresents the class
+      # (inherited members vanish → receiver dispatch degrades to
+      # `Dynamic`) and, worse, a nested reference to an inherited
+      # type re-declares the class as a bare namespace on the RBS
+      # side and can collapse the whole env (the 2026-07-04 redmine
+      # `GitAdapter < AbstractAdapter` crash). Only a plain constant
+      # superclass is emittable: `class X < Foo` / `class X <
+      # Foo::Bar` yields the source token verbatim (RBS resolves it
+      # relative to the emitted namespace, matching Ruby's lexical
+      # scope). A computed superclass (`Struct.new`, `Data.define`,
+      # `Class.new`, any `CallNode`) is left unrecorded — those flow
+      # through the {#register_data_struct_shell} shell path or are
+      # simply un-representable, and guessing would misfold.
+      def record_superclass(node, full)
+        return unless node.is_a?(Prism::ClassNode)
+
+        superclass = qualified_constant_path(node.superclass)
+        @class_superclasses[full] = superclass if superclass
+      end
+
       # ADR-14 gap-#3 (e): recognises
       # `Const = Data.define(...)` and
       # `Const = Struct.new(...)` as class declarations.
@@ -292,6 +316,7 @@ module Rigor
         MethodCandidate.new(
           namespace_kinds: @namespace_kinds,
           class_shells: @class_shells.to_a,
+          class_superclasses: @class_superclasses,
           **
         )
       end

data/lib/rigor/sig_gen/method_candidate.rb

@@ -25,11 +25,11 @@ module Rigor
     class MethodCandidate
       attr_reader :path, :class_name, :method_name, :kind, :classification,
                   :inferred_return, :declared_return_rbs, :rbs, :skip_reason,
-                  :namespace_kinds, :class_shells
+                  :namespace_kinds, :class_shells, :class_superclasses
 
       def initialize(path:, class_name:, method_name:, kind:, classification:, # rubocop:disable Metrics/ParameterLists
                      inferred_return: nil, declared_return_rbs: nil, rbs: nil, skip_reason: nil,
-                     namespace_kinds: {}, class_shells: [])
+                     namespace_kinds: {}, class_shells: [], class_superclasses: {})
         @path = path
         @class_name = class_name
         @method_name = method_name
@@ -41,6 +41,11 @@ module Rigor
         @skip_reason = skip_reason
         @namespace_kinds = namespace_kinds.freeze
         @class_shells = class_shells.freeze
+        # Qualified-class-name => superclass source token (e.g.
+        # `{ "Foo::Bar" => "Base" }`). Only plain-constant
+        # superclasses appear; computed ones are absent. The Writer
+        # emits `class Bar < Base` for the leaf when present.
+        @class_superclasses = class_superclasses.freeze
         freeze
       end
 

data/lib/rigor/sig_gen/writer.rb

@@ -51,6 +51,9 @@ module Rigor
         # Empty until then so the single-target `#write` path
         # falls back to per-candidate kinds only.
         @global_namespace_kinds = {}
+        # Run-level qualified-class-name => superclass-token view,
+        # same lifecycle as `@global_namespace_kinds`.
+        @global_superclasses = {}
       end
 
       # Process the full candidate list by resolving each
@@ -71,6 +74,7 @@ module Rigor
         return [] if emittable.empty?
 
         @global_namespace_kinds = build_namespace_kinds(candidates)
+        @global_superclasses = build_superclasses(candidates)
         emittable.group_by { |c| @path_mapper.target_for(c.path, class_name: c.class_name) }
                  .map { |target, group| write_target(target, group) }
       end
@@ -154,7 +158,8 @@ module Rigor
         shells = collect_class_shells(candidates)
         tree = build_namespace_tree(candidates, shells)
         kinds = merged_namespace_kinds(candidates)
-        render_tree_nodes(tree, kinds, 0)
+        supers = merged_superclasses(candidates)
+        render_tree_nodes(tree, kinds, supers, 0)
       end
 
       # Drains `class_shells` from every candidate; the
@@ -191,6 +196,30 @@ module Rigor
         end
       end
 
+      # Superclass twins of {#merged_namespace_kinds} /
+      # {#build_namespace_kinds}: fold every candidate's
+      # per-file `class_superclasses` map into one view keyed by
+      # qualified class name. Only plain-constant superclasses are
+      # ever recorded (the generator skips computed ones), so a
+      # missing key means "emit no superclass", never "unknown".
+      def merged_superclasses(candidates)
+        merged = @global_superclasses.dup
+        candidates.each do |c|
+          next unless c.respond_to?(:class_superclasses)
+
+          (c.class_superclasses || {}).each { |name, sup| merged[name] = sup }
+        end
+        merged
+      end
+
+      def build_superclasses(candidates)
+        candidates.each_with_object({}) do |candidate, acc|
+          next unless candidate.respond_to?(:class_superclasses)
+
+          (candidate.class_superclasses || {}).each { |name, sup| acc[name] = sup }
+        end
+      end
+
       # A `class` declaration is authoritative and MUST win
       # over the `:module` wrapper default: a compact
       # `class Foo::Bar` never names `Foo`, so the only signal
@@ -234,27 +263,43 @@ module Rigor
         end
       end
 
-      def render_tree_nodes(node, kinds, depth)
-        node[:children].values.map { |child| render_tree_node(child, kinds, depth, [node[:name]].compact) }.join("\n")
+      def render_tree_nodes(node, kinds, supers, depth)
+        node[:children].values.map do |child|
+          render_tree_node(child, kinds, supers, depth, [node[:name]].compact)
+        end.join("\n")
       end
 
-      def render_tree_node(node, kinds, depth, prefix)
+      def render_tree_node(node, kinds, supers, depth, prefix)
         indent = INDENT * depth
         qualified = (prefix + [node[:name]]).join("::")
         keyword = node_keyword(node, kinds, qualified)
-        body = render_tree_node_body(node, kinds, depth, prefix)
-        "#{indent}#{keyword} #{node[:name]}\n#{body}#{indent}end\n"
+        header = "#{keyword} #{node[:name]}#{superclass_suffix(keyword, supers, qualified)}"
+        body = render_tree_node_body(node, kinds, supers, depth, prefix)
+        "#{indent}#{header}\n#{body}#{indent}end\n"
       end
 
-      def render_tree_node_body(node, kinds, depth, prefix)
+      def render_tree_node_body(node, kinds, supers, depth, prefix)
         inner_indent = INDENT * (depth + 1)
         method_lines = node[:methods].map { |c| "#{inner_indent}#{c.rbs}\n" }.join
         child_blocks = node[:children].values.map do |child|
-          render_tree_node(child, kinds, depth + 1, prefix + [node[:name]])
+          render_tree_node(child, kinds, supers, depth + 1, prefix + [node[:name]])
         end.join
         method_lines + child_blocks
       end
 
+      # ` < Super` for a `class` node whose qualified name has a
+      # recorded superclass, else the empty string. A `module`
+      # never takes a superclass (RBS forbids it), so the keyword
+      # gates emission — a name coincidentally recorded as both
+      # (impossible from one source class, but cheap to guard)
+      # stays a bare module.
+      def superclass_suffix(keyword, supers, qualified)
+        return "" unless keyword == :class
+
+        superclass = supers[qualified]
+        superclass ? " < #{superclass}" : ""
+      end
+
       # Per ADR-14 gap-#3 (a) the keyword for a segment comes
       # from `namespace_kinds` when known. The default for an
       # explicit class shell (gap-#3 (e), `Const =
@@ -277,7 +322,8 @@ module Rigor
         return WriteResult.new(source_path: source_path, target_path: target, action: :noop) if decls.nil?
 
         state = MergeState.new(source: source, decls: decls, applied: [], skipped: [])
-        candidates.group_by(&:class_name).each { |class_name, methods| merge_class(state, class_name, methods) }
+        supers = merged_superclasses(candidates)
+        candidates.group_by(&:class_name).each { |class_name, methods| merge_class(state, class_name, methods, supers) }
         merge_class_shells(state, collect_class_shells(candidates), merged_namespace_kinds(candidates))
 
         action = state.applied.empty? ? :noop : :updated
@@ -367,10 +413,10 @@ module Rigor
         nil
       end
 
-      def merge_class(state, class_name, methods)
+      def merge_class(state, class_name, methods, supers = {})
         decl = find_class_decl(state.decls, class_name)
         state.source = if decl.nil?
-                         append_new_class(state.source, class_name, methods, state.applied)
+                         append_new_class(state.source, class_name, methods, state.applied, supers[class_name])
                        else
                          merge_into_existing_class(state.source, decl, methods, state.applied, state.skipped)
                        end
@@ -405,9 +451,10 @@ module Rigor
       # Appends an entirely new `class Foo … end` block at the
       # end of the file (with a leading blank line as
       # separator).
-      def append_new_class(source, class_name, methods, applied)
+      def append_new_class(source, class_name, methods, applied, superclass = nil)
         body = methods.map { |c| "#{INDENT}#{c.rbs}" }.join("\n")
-        snippet = "\nclass #{class_name}\n#{body}\nend\n"
+        header = superclass ? "class #{class_name} < #{superclass}" : "class #{class_name}"
+        snippet = "\n#{header}\n#{body}\nend\n"
         applied.concat(methods)
         ends_with_newline?(source) ? source + snippet : "#{source}\n#{snippet}"
       end

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.2.6"
+  VERSION = "0.2.7"
 end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -76,8 +76,8 @@ module Rigor
         # resolves as `Admin::DomainBlocksController` (matching the
         # `ControllerDiscoverer`), so render paths and filter-chain
         # validation on nested controllers are correct.
-        version: "0.8.0",
-        description: "Validates Action Pack route-helper calls and filter chains inside controllers.",
+        version: "0.9.0",
+        description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request`).",
         config_schema: {
           "controller_search_paths" => { kind: :array, default: ["app/controllers"] },
           "view_search_paths" => { kind: :array, default: ["app/views"] }
@@ -173,8 +173,69 @@ module Rigor
         diagnostics_for(Analyzer.permit_violations_for(call_node: node, model_index: index), path: path, node: node)
       end
 
+      # Phase 5 (2026-07-04) — type the implicit-self request-context
+      # readers (`params`, `session`, `request`, `flash`, `cookies`)
+      # inside controllers. The
+      # typing-obstacle probe
+      # (docs/notes/20260704-rails-coverage-onboarding-carrier-trap.md,
+      # obstacle O3) found `params` typing to `Dynamic[top]` the single
+      # largest protection-coverage hole on real Rails apps: `params[:x]`
+      # is the #1 dispatch cluster (redmine app+lib: `[]` 2378 sites) and
+      # `session[:x] =` a large share of the `[]=` cluster, all
+      # unprotected because the receiver is Dynamic.
+      #
+      # Each returns a bare nominal with NO bundled RBS on purpose. That
+      # makes the reader a *concrete* receiver (so `coverage --protection`
+      # counts the site as protected and the dispatch resolves against a
+      # named class) while its method surface stays engine-lenient — Rigor
+      # does not fire `undefined-method` on a class it has no RBS for, so
+      # `params.require(...).permit(...)`, `session.delete(:x)`,
+      # `request.xhr?`, and every other method on these stay FP-safe.
+      # Shipping a partial RBS would re-introduce the carrier-additivity
+      # trap (a declared class drops every member the RBS omits → false
+      # `undefined-method`). ADR-5: this types the container, never the
+      # caller's argument, so the values stay lenient.
+      REQUEST_CONTEXT_READER_TYPES = {
+        params: "ActionController::Parameters",
+        session: "ActionDispatch::Request::Session",
+        request: "ActionDispatch::Request",
+        flash: "ActionDispatch::Flash::FlashHash",
+        cookies: "ActionDispatch::Cookies::CookieJar"
+      }.freeze
+
+      dynamic_return methods: REQUEST_CONTEXT_READER_TYPES.keys do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+        next nil unless call_node.receiver.nil?   # the implicit-self reader
+        next nil unless call_node.arguments.nil?  # `params`, not `params(x)`
+        next nil unless controller_scope?(scope)
+
+        class_name = REQUEST_CONTEXT_READER_TYPES[call_node.name]
+        next nil if class_name.nil?
+
+        Rigor::Type::Combinator.nominal_of(class_name)
+      end
+
       private
 
+      # True when the current `self` is a controller — the enclosing
+      # class is one the discoverer indexed, or its name follows the
+      # Rails `*Controller` convention (covering controllers outside
+      # `controller_search_paths`, e.g. one shipped by an engine).
+      # Typing `params` is precision-additive, so the name-convention
+      # fallback is FP-safe.
+      def controller_scope?(scope)
+        self_type = scope&.self_type
+        return false unless self_type.respond_to?(:class_name)
+
+        name = self_type.class_name
+        return false if name.nil?
+
+        index = producer_value(:controller_index)
+        return true if index && (index.find(name) || index.find("::#{name}"))
+
+        name.end_with?("Controller")
+      end
+
       def controller_file?(path)
         @controller_search_paths.any? do |root|
           # The runner may pass `path` as either an absolute

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord.rb

@@ -208,9 +208,8 @@ module Rigor
       FINDER_METHOD_NAMES = %i[find find_by! find_by where all order limit none select].freeze
       private_constant :FINDER_METHOD_NAMES
 
-      # v0.1.2 — return-type contribution; ADR-52 slice 5b —
-      # migrated off `flow_contribution_for` onto the run-time
-      # `methods:` name gate. `Model.find(id)` narrows the call
+      # Return-type contribution via the run-time `methods:` name
+      # gate (ADR-52 slice 5b). `Model.find(id)` narrows the call
       # site's return type to `Nominal[Model]`, so chained calls
       # (`User.find(1).name`) resolve through the analyzer's
       # normal dispatch instead of the RBS-level untyped