1 line
3.0 KiB
Plaintext
1 line
3.0 KiB
Plaintext
Project Sentinel: Ruby Language ProfileVersion: 3.0.0-EnterpriseModule: 29-Lang-RubyMaps to: examples/ruby/Scope: Active enforcement of Rails best practices, Brakeman security scanning, and RSpec testing standards.1. The Ruby Ecosystem AdapterSentinel detects a Ruby project via Gemfile. It enforces the use of Bundler for all execution.1.1 The Bundler JailRule: Never install gems globally.Enforcement:Sentinel aliases gem install to a blocking function.Correct Flow: Agent must use bundle add <gem>.Integrity: After any Gemfile edit, Sentinel forces a bundle install and verifies Gemfile.lock was updated before allowing a commit.1.2 Ruby Version Manager (RVM/rbenv)Rule: .ruby-version must exist.Enforcement:On sentinel init, checks for version file.If missing, prompts the Agent to create one based on the installed ruby version.This prevents "It works on my machine" errors regarding Ruby 2.7 vs 3.x syntax changes.2. Rails Security (Brakeman)Sentinel integrates Brakeman, a static analysis tool designed specifically for Rails.2.1 Mass Assignment ProtectionThreat: User updates is_admin flag via params injection.Enforcement:Sentinel runs Brakeman on every write_file to a Controller.Check: permit! (Allow all) usage.Action: BLOCKED.Message: "Security Violation: permit! allows Mass Assignment. Whitelist attributes using permit(:attr1, :attr2)."2.2 Dangerous EvaluationThreat: Usage of eval, class_eval, instance_eval with user input.Enforcement:Sentinel Greps for eval(params[:x]).Action: CRITICAL BLOCK.Log: This triggers a Security Incident in the Audit DB.3. Code Style (RuboCop)Ruby syntax is flexible, which is dangerous for Agents. Sentinel enforces consistency.3.1 The Style GuideMechanism: Sentinel executes rubocop with a strict .rubocop.yml.Common Corrections:Enforces snake_case for methods.Enforces standard indentation (2 spaces).Auto-Correct: Sentinel runs rubocop -A (Safe Autocorrect) automatically on file save.3.2 Complexity LimitsRule: Methods should fit on a screen.Enforcement:RuboCop Metrics/MethodLength.If a method > 20 lines, Sentinel rejects it.Prompt: "Method process_order is too long (45 lines). Refactor into helper methods."4. Testing (RSpec)4.1 The "Expect" SyntaxRule: Use expect(...).to, never should.Enforcement:Sentinel scans spec files for the deprecated should syntax.Action: Flags as "Deprecated Syntax".4.2 FactoryBot HygieneRule: build over create where possible (Performance).Enforcement:If an Agent uses create(:user) in a Unit Test that doesn't touch the DB, Sentinel suggests: "Optimization: Use build_stubbed or build to avoid DB hit."5. Deployment Checks (Capistrano/Heroku)5.1 Migration SafetyRule: Migrations must be reversible.Enforcement:Sentinel checks db/migrate files.Check: Usage of change vs up/down.If up contains raw SQL without a corresponding down, Sentinel warns: "Irreversible Migration detected."5.2 Secret Key BaseRule: config/master.key must be gitignored.Enforcement:Standard VFS Jail check. Sentinel ensures credentials files are never committed. |