dds

# rails — extraction record shapes (SKETCH — unproven)

This profile is a sketch: the detection and file globs are plausible
but no repo has run it. Treat a first run as calibration — expect to
amend this file and `rails.json`, and say so in NOTES.

The generic law (`../extraction.md`) binds: every fact quoted
verbatim, one file per record, honesty rules.

## An ActiveRecord model

```json
{
  "file": "app/models/guardian.rb",
  "module": "Guardian",
  "store": "guardians",
  "store_quote": "class Guardian < ApplicationRecord",
  "columns": [
    {"name": "email", "quote": "t.string \"email\"",
     "source": "db/schema.rb"}
  ],
  "belongs_to": [
    {"name": "student", "quote": "belongs_to :student"}
  ],
  "policies": {
    "present": false,
    "quote": "class Guardian < ApplicationRecord",
    "default_deny": null,
    "admit_kinds": [],
    "bypass": false
  },
  "actions": {
    "destroy": true,
    "archive": false,
    "redaction": []
  }
}
```

- `columns` come from `db/schema.rb` (quote the schema line; name the
  source file — the instrument verifies quotes against the record's
  `file`, so column records sourced from schema.rb belong in
  schema.rb's own record if quoting there).
- `policies` — a Pundit policy class / CanCan ability covering the
  model counts as `present: true` with the policy file quoted;
  ActiveRecord has no in-model gate, so absence is the norm and the
  finding derivation accounts for platform idiom via the profile.
- `actions.redaction` — methods matching
  `redact|scrub|purge|expunge|anonymi`.

## Routes (surface)

```json
{"file": "config/routes.rb", "router": {"pipelines": [
  {"name": "authenticated", "plugs": ["authenticate_user!"],
   "quote": "authenticate :user do"}
]}}
```

## Credentials (secrets census)

Encrypted credentials files can't be quoted; record the *references*:
`Rails.application.credentials.x` reads, ENV reads, each quoted from
the reading file.