@codyswann/lisa 2.121.1 → 2.122.0

package/plugins/lisa-rails-agy/agents/ops-specialist.md

@@ -0,0 +1,226 @@
+---
+name: ops-specialist
+description: Operations specialist agent for Rails applications deployed with Kamal on ECS Fargate. Manages local Docker Compose, deploys via Kamal, checks CloudWatch logs, monitors Solid Queue jobs, verifies OpenTelemetry traces, manages database operations, and handles secrets/config via AWS SSM and Secrets Manager.
+tools: Read, Grep, Glob, Bash
+skills:
+  - ops-run-local
+  - ops-deploy
+  - ops-check-logs
+  - ops-verify-jobs
+  - ops-verify-telemetry
+---
+
+# Ops Specialist Agent
+
+You are an operations specialist for a Ruby on Rails application deployed with Kamal on AWS ECS Fargate. Your mission is to **run, monitor, deploy, debug, and maintain the application** across local and remote environments. You operate with full operational knowledge embedded in this prompt — you do not need to search for setup instructions.
+
+## Architecture Summary
+
+| Layer | Stack | Key Tech |
+|-------|-------|----------|
+| Application | Ruby on Rails 8 | Propshaft, Importmap, Solid Queue, Solid Cache, Solid Cable |
+| Database | PostgreSQL (multi-database) | Primary, Queue, Cache, Cable databases |
+| Background Jobs | Solid Queue | Database-backed, no Redis dependency |
+| Deployment | Kamal v2 | Docker multi-stage builds, ECS Fargate |
+| Monitoring | OpenTelemetry | CloudWatch Metrics/Logs, AWS X-Ray |
+| Secrets | AWS Secrets Manager + SSM Parameter Store | Per-environment secrets and config |
+| CI/CD | GitHub Actions | Quality checks, auto-deploy on branch push |
+| Security | Brakeman, Bundler Audit, Rack::Attack | Static analysis, dependency audit, rate limiting |
+
+## Project Discovery
+
+On first invocation, discover project-specific values by reading these files:
+
+| Value | Source File | How to Extract |
+|-------|------------|----------------|
+| App name | `config/deploy.yml` | `service:` key |
+| Docker registry | `config/deploy.yml` | `registry:` and `image:` keys |
+| Deploy servers | `config/deploy.yml` | `servers:` section, per-role hosts |
+| Environment URLs | `config/deploy.staging.yml`, `config/deploy.production.yml` | `proxy.host:` or `env.clear.APPLICATION_HOST` |
+| Database config | `config/database.yml` | Multi-database setup (primary, queue, cache, cable) |
+| Solid Queue config | `config/solid_queue.yml` or `config/queue.yml` | Workers, dispatchers, recurring jobs |
+| Background jobs | `app/jobs/` directory | All `ApplicationJob` subclasses |
+| AWS region | `config/deploy.yml` or `.env` files | `AWS_REGION` or inferred from ECS cluster |
+| SSM prefix | `config/deploy.yml` | `env.secret:` entries referencing SSM paths |
+| Health check path | `config/routes.rb` | `get "up" => "rails/health#show"` or custom health route |
+| Docker Compose | `docker-compose.yml` or `compose.yaml` | Local development service definitions |
+| Kamal accessories | `config/deploy.yml` | `accessories:` section (databases, Redis, etc.) |
+| Ruby version | `.ruby-version` | Ruby version string |
+| Bundler scripts | `Gemfile` | Key gems and their versions |
+| Rake tasks | `lib/tasks/` | Custom rake tasks for ops |
+
+## Skills Reference
+
+| Skill | Purpose |
+|-------|---------|
+| `ops-run-local` | Start, stop, restart, or check status of local Docker Compose development environment |
+| `ops-deploy` | Deploy via Kamal or CI/CD branch push to staging or production |
+| `ops-check-logs` | View local Docker Compose logs or remote CloudWatch logs |
+| `ops-verify-jobs` | Verify Solid Queue background jobs are running and healthy |
+| `ops-verify-telemetry` | Verify OpenTelemetry traces are being collected and exported to X-Ray |
+
+## Database Operations
+
+Database operations are handled inline by this agent (no separate skill needed for Rails — the CLI is simpler than TypeORM).
+
+### Migration Status
+
+```bash
+bin/rails db:migrate:status
+```
+
+### Run Pending Migrations
+
+```bash
+bin/rails db:migrate
+```
+
+**For remote environments** (via Kamal):
+
+```bash
+kamal app exec --roles=web "bin/rails db:migrate" -d staging
+```
+
+### Strong Migrations Compliance
+
+```bash
+bin/rails db:migrate 2>&1 | grep -i "strong_migrations"
+```
+
+Check for unsafe migrations before deploying:
+
+```bash
+bundle exec rubocop --only Rails/StrongMigrations db/migrate/
+```
+
+### Multi-Database Health
+
+```bash
+bin/rails runner "
+  ActiveRecord::Base.connected_to(role: :writing) do
+    puts 'Primary: ' + ActiveRecord::Base.connection.execute('SELECT 1').first.values.join
+  end
+  ActiveRecord::Base.connected_to(database: :queue) do
+    puts 'Queue: ' + ActiveRecord::Base.connection.execute('SELECT 1').first.values.join
+  end rescue puts 'Queue: NOT CONFIGURED'
+  ActiveRecord::Base.connected_to(database: :cache) do
+    puts 'Cache: ' + ActiveRecord::Base.connection.execute('SELECT 1').first.values.join
+  end rescue puts 'Cache: NOT CONFIGURED'
+  ActiveRecord::Base.connected_to(database: :cable) do
+    puts 'Cable: ' + ActiveRecord::Base.connection.execute('SELECT 1').first.values.join
+  end rescue puts 'Cable: NOT CONFIGURED'
+"
+```
+
+## Secrets and Config Management
+
+### SSM Parameter Store Lookups
+
+Discover the SSM prefix from `config/deploy.yml` `env.secret:` entries.
+
+```bash
+aws ssm get-parameters-by-path \
+  --path "/{app_name}/{environment}" \
+  --with-decryption \
+  --region {aws-region} \
+  --query 'Parameters[].{Name:Name,Type:Type,LastModified:LastModifiedDate}' \
+  --output table
+```
+
+### Secrets Manager Status
+
+```bash
+aws secretsmanager list-secrets \
+  --region {aws-region} \
+  --filters Key=name,Values="{app_name}" \
+  --query 'SecretList[].{Name:Name,LastChanged:LastChangedDate}' \
+  --output table
+```
+
+### Environment Comparison
+
+Compare secrets between staging and production:
+
+```bash
+diff <(aws ssm get-parameters-by-path --path "/{app_name}/staging" --region {aws-region} --query 'Parameters[].Name' --output text | tr '\t' '\n' | sed "s|/{app_name}/staging/||" | sort) \
+     <(aws ssm get-parameters-by-path --path "/{app_name}/production" --region {aws-region} --query 'Parameters[].Name' --output text | tr '\t' '\n' | sed "s|/{app_name}/production/||" | sort)
+```
+
+## Health Checks
+
+### Local Health Check
+
+```bash
+curl -sf -o /dev/null -w "HTTP %{http_code} in %{time_total}s" http://localhost:3000/up
+```
+
+### Remote Health Check
+
+Discover the application URL from `config/deploy.{environment}.yml` or environment variables:
+
+```bash
+curl -sf -o /dev/null -w "HTTP %{http_code} in %{time_total}s" https://{app_host}/up
+```
+
+### ECS Service Stability
+
+```bash
+aws ecs describe-services \
+  --cluster {cluster-name} \
+  --services {service-name} \
+  --region {aws-region} \
+  --query 'services[0].{Status:status,Running:runningCount,Desired:desiredCount,Deployments:deployments[].{Status:status,Running:runningCount,Desired:desiredCount,Rollout:rolloutState}}' \
+  --output json
+```
+
+### Full Health Check Script
+
+```bash
+check_env() {
+  local ENV=$1
+  local URL=$2
+
+  echo "=== $ENV ==="
+
+  # Rails /up endpoint
+  STATUS=$(curl -sf -o /dev/null -w "%{http_code}" --max-time 10 "$URL/up" 2>/dev/null || echo "000")
+  TIME=$(curl -sf -o /dev/null -w "%{time_total}" --max-time 10 "$URL/up" 2>/dev/null || echo "timeout")
+  echo "Health: HTTP $STATUS ($TIME s)"
+
+  # Database connectivity (via /up — Rails health check verifies DB by default)
+  BODY=$(curl -sf --max-time 10 "$URL/up" 2>/dev/null || echo "UNREACHABLE")
+  echo "Body:   $BODY"
+  echo ""
+}
+```
+
+## Troubleshooting Quick Reference
+
+| Problem | Likely Cause | Fix |
+|---------|-------------|-----|
+| `port 3000 already in use` | Previous Rails server running | `lsof -ti :3000 \| xargs kill -9` |
+| `docker compose up` fails | Docker Desktop not running | Start Docker Desktop, then retry |
+| `PG::ConnectionBad` | PostgreSQL not running or wrong credentials | Check `docker compose ps` for postgres container; verify `DATABASE_URL` |
+| Kamal deploy hangs | SSH key not added or wrong host | Verify `ssh {host}` works; check `config/deploy.yml` servers |
+| `kamal lock release` needed | Previous deploy interrupted | Run `kamal lock release -d {env}` then retry |
+| Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
+| Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
+| `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
+| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
+| OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
+| `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |
+
+## Rules
+
+- Always verify empirically — never assume something works because the code looks correct
+- Always discover project-specific values from source files before operations
+- Always check prerequisites (Docker, ports, AWS credentials) before operations
+- Always read `config/deploy.yml` to discover Kamal configuration before deploy operations
+- Never deploy to production without explicit human confirmation
+- Never run destructive database operations (drop, reset, rollback) without explicit human confirmation
+- Always use the correct AWS profile and region for CLI commands (discover from deploy config)
+- Always start Docker Compose services before running Rails commands locally
+- Always check ECS service stability after deployments (running count matches desired count)
+- Always report results in structured tables
+- Always check Strong Migrations compliance before running migrations on remote databases

package/plugins/lisa-rails-agy/commands/e2e-coverage-gaps.md

@@ -0,0 +1,7 @@
+---
+description: "Explore gaps in the automated Playwright/e2e suite: inventory the app's routes and existing tests, find routes with no coverage or flows tested only on the happy path (missing error, permission, empty, loading, and edge cases), confirm each in the running app, and file one build-ready missing-test ticket per gap via lisa:tracker-write. The optional ready flag (default true) controls build-ready vs backlog. For human usability issues, use exploratory-qa instead."
+allowed-tools: ["Skill"]
+argument-hint: "[target-url | env] [ready=true|false]"
+---
+
+Use the /lisa-rails:e2e-coverage-gaps skill to inventory the app's routes and the existing Playwright suite, find uncovered and happy-path-only paths, confirm each gap in the running app, and file one build-ready missing-test ticket per gap via lisa:tracker-write (build-ready per the ready flag, default true). For human usability/experience findings, use /lisa-rails:exploratory-qa. $ARGUMENTS

package/plugins/lisa-rails-agy/commands/exploratory-qa.md

@@ -0,0 +1,7 @@
+---
+description: "Run a first-time-user exploratory QA walkthrough: experience the app like a brand-new human user, clicking through to find anything confusing, broken, or hard to understand (machine-style labels, slow or unclear loads, cramped or cut-off UI, inconsistent UX, awkward scroll behavior) across all breakpoints, and file each finding (bug or usability issue) as a tracked work item via lisa:tracker-write. The optional ready flag marks tickets build-ready (auto-picked-up by lisa:intake) or leaves them in the backlog for human triage (default). For gaps in the automated Playwright suite, use e2e-coverage-gaps instead."
+allowed-tools: ["Skill"]
+argument-hint: "[target-url | env] [ready=true|false]"
+---
+
+Use the /lisa-rails:exploratory-qa skill to experience the app like a brand-new first-time user — landing cold on the home page and clicking through to find anything confusing, broken, or hard to understand across all breakpoints — and file each finding (bugs, usability/clarity issues) as a tracked work item via lisa:tracker-write, build-ready or in triage per the ready flag (default: triage). For automated Playwright coverage gaps, use /lisa-rails:e2e-coverage-gaps. $ARGUMENTS

package/plugins/lisa-rails-agy/commands/fix/linter-error.md

@@ -0,0 +1,7 @@
+---
+description: "Fix all violations of one or more ESLint rules across the codebase"
+allowed-tools: ["Skill"]
+argument-hint: "<rule-1> [rule-2] [rule-3] ..."
+---
+
+Use the /lisa-rails:fix-linter-error skill to fix linter errors. $ARGUMENTS

package/plugins/lisa-rails-agy/commands/improve/code-complexity.md

@@ -0,0 +1,6 @@
+---
+description: "Reduce the cognitive complexity threshold by 2 and fix all violations"
+allowed-tools: ["Skill"]
+---
+
+Use the /lisa-rails:improve-code-complexity skill to lower code complexity.

package/plugins/lisa-rails-agy/commands/improve/max-lines-per-function.md

@@ -0,0 +1,7 @@
+---
+description: "Reduce max lines per function threshold and fix violations"
+allowed-tools: ["Skill"]
+argument-hint: "<max-lines-per-function-value>"
+---
+
+Use the /lisa-rails:improve-max-lines-per-function skill to reduce max function lines. $ARGUMENTS

package/plugins/lisa-rails-agy/commands/improve/max-lines.md

@@ -0,0 +1,7 @@
+---
+description: "Reduce max file lines threshold and fix violations"
+allowed-tools: ["Skill"]
+argument-hint: "<max-lines-value>"
+---
+
+Use the /lisa-rails:improve-max-lines skill to reduce max lines. $ARGUMENTS

package/plugins/lisa-rails-agy/commands/improve/test-coverage.md

@@ -0,0 +1,7 @@
+---
+description: "Increase test coverage to a specified threshold percentage"
+allowed-tools: ["Skill"]
+argument-hint: "<threshold-percentage>"
+---
+
+Use the /lisa-rails:improve-test-coverage skill to increase test coverage. $ARGUMENTS

package/plugins/lisa-rails-agy/plugin.json

@@ -0,0 +1,11 @@
+{
+  "name": "lisa-rails",
+  "version": "2.122.0",
+  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
+  "author": {
+    "name": "Cody Swann"
+  },
+  "dependencies": [
+    "lisa"
+  ]
+}

package/plugins/lisa-rails-agy/skills/action-controller-best-practices/SKILL.md

@@ -0,0 +1,374 @@
+---
+name: action-controller-best-practices
+description: Build or Refactor large Rails controller files into clean, maintainable code. Use when a controller action exceeds ~10 lines, a controller has custom non-RESTful actions, or when the user asks to refactor, slim down, clean up, or organize a Rails controller. Applies patterns: service objects, query objects, form objects, controller concerns, presenters/decorators, and RESTful resource extraction.
+---
+
+# Rails Controller Refactoring
+
+Controllers should be thin traffic cops — they receive input via params, delegate to the appropriate object, and decide what to render or redirect. Each action should be roughly 5-10 lines. If an action is longer, logic needs to be extracted.
+
+## Decision Framework
+
+Read the controller and classify each block of code:
+
+| Code type                                               | Extract to             | Location                               |
+| ------------------------------------------------------- | ---------------------- | -------------------------------------- |
+| Business logic, multi-step operations, side effects     | Service object         | `app/services/`                        |
+| Complex queries, filtering, sorting, search             | Query object           | `app/queries/`                         |
+| Context-specific param validation and persistence       | Form object            | `app/forms/`                           |
+| Shared before_actions, auth, pagination, error handling | Controller concern     | `app/controllers/concerns/`            |
+| Complex view data assembly, formatting, display logic   | Presenter / Decorator  | `app/presenters/` or `app/decorators/` |
+| Non-RESTful custom actions on a different concept       | New RESTful controller | `app/controllers/`                     |
+| Simple CRUD, strong params, render/redirect             | Keep on controller     | —                                      |
+
+## Patterns
+
+### Service Objects
+
+Use for any business logic that goes beyond simple CRUD. A controller action should call one service at most.
+
+Before:
+
+```ruby
+def create
+  @player = Player.new(player_params)
+  @player.team = Team.find(params[:team_id])
+  @player.contract_start = Time.current
+  @player.status = :active
+
+  if @player.save
+    PlayerMailer.welcome(@player).deliver_later
+    Analytics.track("player_signed", player_id: @player.id)
+    NotifyScoutsJob.perform_later(@player.team_id)
+    redirect_to @player, notice: "Player signed"
+  else
+    render :new, status: :unprocessable_entity
+  end
+end
+```
+
+After:
+
+```ruby
+# Controller
+def create
+  result = Players::SignPlayer.new(player_params, team_id: params[:team_id]).call
+
+  if result.success?
+    redirect_to result.player, notice: "Player signed"
+  else
+    @player = result.player
+    render :new, status: :unprocessable_entity
+  end
+end
+
+# app/services/players/sign_player.rb
+module Players
+  class SignPlayer
+    def initialize(params, team_id:)
+      @params = params
+      @team_id = team_id
+    end
+
+    def call
+      player = Player.new(@params)
+      player.team = Team.find(@team_id)
+      player.contract_start = Time.current
+      player.status = :active
+
+      if player.save
+        send_notifications(player)
+        Result.new(success: true, player: player)
+      else
+        Result.new(success: false, player: player)
+      end
+    end
+
+    private
+
+    def send_notifications(player)
+      PlayerMailer.welcome(player).deliver_later
+      Analytics.track("player_signed", player_id: player.id)
+      NotifyScoutsJob.perform_later(player.team_id)
+    end
+
+    Result = Struct.new(:success, :player, keyword_init: true) do
+      alias_method :success?, :success
+    end
+  end
+end
+```
+
+### Query Objects
+
+Use when index actions have complex filtering, sorting, or search logic.
+
+Before:
+
+```ruby
+def index
+  @players = Player.where(team_id: params[:team_id])
+  @players = @players.where(position: params[:position]) if params[:position].present?
+  @players = @players.where("age >= ?", params[:min_age]) if params[:min_age].present?
+  @players = @players.where(status: :active) unless params[:include_inactive]
+  @players = @players.joins(:stats).order("stats.war DESC")
+  @players = @players.page(params[:page]).per(25)
+end
+```
+
+After:
+
+```ruby
+# Controller
+def index
+  @players = Players::FilterQuery.new(params).call
+end
+
+# app/queries/players/filter_query.rb
+module Players
+  class FilterQuery
+    def initialize(params, relation: Player.all)
+      @params = params
+      @relation = relation
+    end
+
+    def call
+      filter_by_team
+      filter_by_position
+      filter_by_age
+      filter_by_status
+      sort_and_paginate
+      @relation
+    end
+
+    private
+
+    def filter_by_team
+      @relation = @relation.where(team_id: @params[:team_id]) if @params[:team_id].present?
+    end
+
+    def filter_by_position
+      @relation = @relation.where(position: @params[:position]) if @params[:position].present?
+    end
+
+    def filter_by_age
+      @relation = @relation.where("age >= ?", @params[:min_age]) if @params[:min_age].present?
+    end
+
+    def filter_by_status
+      @relation = @relation.where(status: :active) unless @params[:include_inactive]
+    end
+
+    def sort_and_paginate
+      @relation = @relation.joins(:stats).order("stats.war DESC").page(@params[:page]).per(25)
+    end
+  end
+end
+```
+
+### Controller Concerns
+
+Use for shared behavior across multiple controllers: authentication, authorization, pagination, error handling, locale setting.
+
+```ruby
+# app/controllers/concerns/paginatable.rb
+module Paginatable
+  extend ActiveSupport::Concern
+
+  private
+
+  def page
+    params[:page] || 1
+  end
+
+  def per_page
+    [params[:per_page].to_i, 100].min.nonzero? || 25
+  end
+end
+
+# app/controllers/concerns/error_handleable.rb
+module ErrorHandleable
+  extend ActiveSupport::Concern
+
+  included do
+    rescue_from ActiveRecord::RecordNotFound, with: :not_found
+    rescue_from ActionController::ParameterMissing, with: :bad_request
+  end
+
+  private
+
+  def not_found
+    render json: { error: "Not found" }, status: :not_found
+  end
+
+  def bad_request(exception)
+    render json: { error: exception.message }, status: :bad_request
+  end
+end
+```
+
+Guidelines for controller concerns:
+
+- Each concern should handle one cross-cutting aspect
+- Don't use concerns to just split a large controller into files — that hides complexity
+- Good candidates: auth, error handling, pagination, locale, current tenant scoping
+- Bad candidates: domain-specific business logic
+
+### Presenters / Decorators
+
+Use when an action assembles complex data for the view that isn't a direct model attribute. Keeps view logic out of the controller.
+
+```ruby
+# app/presenters/player_dashboard_presenter.rb
+class PlayerDashboardPresenter
+  def initialize(player)
+    @player = player
+  end
+
+  def career_stats
+    @career_stats ||= @player.stats.group(:season).sum(:war)
+  end
+
+  def contract_status_label
+    return "Free Agent" if @player.contract_end&.past?
+    "Under Contract (#{@player.contract_end&.year})"
+  end
+
+  def trade_value_rating
+    case @player.trade_value
+    when 90.. then "Elite"
+    when 70..89 then "High"
+    when 50..69 then "Average"
+    else "Low"
+    end
+  end
+end
+
+# Controller
+def show
+  @player = Player.find(params[:id])
+  @presenter = PlayerDashboardPresenter.new(@player)
+end
+```
+
+### RESTful Resource Extraction
+
+When a controller has custom non-RESTful actions, it usually means there's a hidden resource. Extract it into its own controller with standard CRUD actions.
+
+Before:
+
+```ruby
+class PlayersController < ApplicationController
+  def trade
+    # ...
+  end
+
+  def release
+    # ...
+  end
+
+  def promote_to_roster
+    # ...
+  end
+end
+```
+
+After:
+
+```ruby
+# config/routes.rb
+resources :players do
+  resource :trade, only: [:new, :create], controller: "players/trades"
+  resource :release, only: [:create], controller: "players/releases"
+  resource :roster_promotion, only: [:create], controller: "players/roster_promotions"
+end
+
+# app/controllers/players/trades_controller.rb
+module Players
+  class TradesController < ApplicationController
+    def new
+      @player = Player.find(params[:player_id])
+    end
+
+    def create
+      result = Players::TradePlayer.new(Player.find(params[:player_id]), trade_params).call
+      # ...
+    end
+  end
+end
+```
+
+Signs you need a new controller:
+
+- Action name is a verb that isn't a CRUD verb (trade, approve, archive, publish)
+- Action operates on a different concept than the controller's resource
+- Controller has more than the 7 RESTful actions
+
+## Refactoring Process
+
+1. **Read the entire controller** and identify every action, before_action, and private method.
+2. **Inline hidden code first.** Copy logic from before_actions, helper methods, and parent classes into each action so you can see the full picture.
+3. **Classify each block** using the decision framework table above.
+4. **Extract in order**: RESTful resource extraction first (new controllers), then service objects, query objects, form objects, presenters, and finally concerns.
+5. **Slim down each action** to: find/build the resource, call a service or query, render or redirect. Each action should be 5-10 lines.
+6. **Clean up strong params.** Each controller should have one `_params` method. If you need different permitted params per action, consider separate controllers or form objects.
+7. **Create or update tests** for each extracted class with its own spec file.
+
+## What the Controller Should Look Like After
+
+```ruby
+class PlayersController < ApplicationController
+  before_action :set_player, only: [:show, :edit, :update, :destroy]
+
+  def index
+    @players = Players::FilterQuery.new(params).call
+  end
+
+  def show
+    @presenter = PlayerDashboardPresenter.new(@player)
+  end
+
+  def create
+    result = Players::SignPlayer.new(player_params, team_id: params[:team_id]).call
+
+    if result.success?
+      redirect_to result.player, notice: "Player signed"
+    else
+      @player = result.player
+      render :new, status: :unprocessable_entity
+    end
+  end
+
+  def update
+    if @player.update(player_params)
+      redirect_to @player, notice: "Player updated"
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    @player.destroy
+    redirect_to players_path, notice: "Player removed"
+  end
+
+  private
+
+  def set_player
+    @player = Player.find(params[:id])
+  end
+
+  def player_params
+    params.require(:player).permit(:name, :position, :age, :team_id)
+  end
+end
+```
+
+## What NOT to Do
+
+- Don't put business logic in before_actions — they obscure the flow of an action.
+- Don't use instance variables to pass data between before_actions and actions in complex ways.
+- Don't rescue broad exceptions in individual actions — use a concern or `rescue_from`.
+- Don't add non-RESTful actions to a controller when a new controller would be clearer.
+- Don't create deeply nested service call chains — one service per action is the goal.
+- Don't move logic to private methods and call it refactored — private methods still live in the controller.