メニュー
Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Review Ruby/Rails code like DHH would - direct, opinionated, allergic to over-engineering. Use when the user runs /dhh or asks for a DHH-style review of a diff, file, or recent changes.
Apply Hotwire, Turbo, Stimulus, and ActionCable best practices for real-time Rails interfaces. Use when building Turbo Streams/Frames, Stimulus interactions, or websocket-driven updates.
Apply best practices for Rails background jobs using simple orchestration, idempotency, and safe retries. Use when creating, refactoring, or debugging Active Job and queue-backed workflows.
Write and review Rails database migrations safely, including reversible changes, lock-aware operations, and rollout sequencing. Use when adding or changing schema, indexes, constraints, or backfills.
Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.
Apply Rails testing standards with Minitest, fixtures, and pragmatic coverage boundaries. Use when creating tests, reviewing test quality, or improving flaky and slow Rails test suites.
| name | rails-best-practices-core |
| description | Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent. |
Use this as the default baseline for Rails work. Distilled from 37signals codebases (Campfire, Fizzy) and DHH's review patterns.
dependent: :delete_all when no callbacks needed).params.expect(...) for strong params in modern Rails.create!), handle exceptions at boundaries. Only use ! when a non-bang counterpart exists.enqueue_after_transaction_commit over retry logic for races).closed: boolean, create a Closure record with creator and timestamps. You get who/when for free, and scoping is trivial:has_one :closure, dependent: :destroy
scope :closed, -> { joins(:closure) }
scope :open, -> { where.missing(:closure) }
Closeable, Watchable, Assignable), each self-contained (associations + scopes + methods), ~50-150 lines, cohesive. Prefer nested modules under the model's namespace (Card::Closeable in app/models/card/closeable.rb) for domain slices; reserve app/models/concerns/ for genuinely cross-model behavior. Never extract concerns containing only private methods.app/models/, not app/services/: presentation objects (Event::Description), complex operations (SystemCommenter), view-context bundles (User::Filtering). They're model-adjacent, not controller-adjacent.belongs_to :creator, class_name: "User", default: -> { Current.user }; belongs_to :account, default: -> { board.account }.Current.user, Current.account), with cascading setters (assigning session resolves identity, which resolves user for the account).normalizes (data cleanup before validation), store_accessor (JSON columns), delegated_type (heterogeneous collections), generates_token_for (expiring signed tokens), string enums via enum :status, %w[drafted published].index_by(&:itself), after_save_commit, touch: true chains for cache invalidation, delegate.grant_to/revise on the has_many proxy; use insert_all for bulk creates and dependent: :delete_all on join tables with no callbacks.to_param with a per-tenant number rather than exposing raw IDs/UUIDs.Closure beats CardClose; Mention beats UserReference.active not not_deleted, visible not not_hidden.belongs_to :creator, class_name: "User" not belongs_to :user.quota.depleted? not quota.over_limit?.:active, :unassigned, :golden — not SQL-ish :without_pop.source/resource/container for one concept.resource :closure (POST closes, DELETE reopens); publish → resource :publication. No custom member actions.resource for one-per-parent state; scope module: to group nested controllers (Cards::ClosuresController); shallow nesting for deep hierarchies.CardScoped sets @card via Current.user.accessible_cards.find_by!(...)) shared across nested controllers, including shared Turbo render helpers.resolve "Comment" for polymorphic URL generation to the parent with an anchor.respond_to — no separate API namespace.card.editable_by?(user), user.can_administer_board?(board)).head :forbidden unless ...), models define what the permission means.allow_unauthenticated_access, ensure_can_administer.Before adding a gem ask: can vanilla Rails do this? Is 50-150 lines in-repo simpler than a dependency? Commonly skipped: Devise, Pundit, ViewComponent, RSpec, FactoryBot, Redis (Solid Queue/Cache/Cable use the DB), service objects, form objects, decorators, GraphQL, SPA frameworks, Tailwind.
Comment.find(params[:id]))..map(&:name) where .pluck(:name) works).fresh_when/etag) — stale CSRF tokens cause 422s.status == "x") when predicate-style APIs are available (StringInquirer / string enums).validates :x, uniqueness: true without a backing unique index.html_safe strings — escape first: "<b>#{h(input)}</b>".html_safe.Ship it or a short prioritized fix list.