Rails Conventions
Core Philosophy
- Rich models - Business logic lives in models, not service objects
- Everything is CRUD - New resource over new action (
resource :closure not post :close)
- State as records -
Closure model instead of closed: boolean
- Concerns for composition -
Closeable, Watchable, Commentable
- Explicit over clever - Inline until repetition is real; an abstraction earns its place, it isn't built on speculation
- Small interfaces - No public method without a caller
- Let it crash - Bang methods (
create!), handle failures at the boundary, not by pre-guarding (references/error-handling.md)
- Invariants in the schema - Hard rules (presence, uniqueness, ranges) are NOT NULL / unique / check constraints; validations are for user-facing messages, not the source of truth. References stay soft: no foreign keys, integrity at the model layer
- Minimal dependencies - Build it yourself before reaching for gems. No Devise, Pundit, RSpec, FactoryBot, ViewComponent, service/form objects, or decorators
- Database-backed - Solid Queue/Cache/Cable, no Redis
- Test coverage - Maintain roughly 1:1 test ratio (1 line test per line of code)
Reference Selection
This table is an index, not the content. The conventions live in the reference files, not in this table, the codebase, or general Rails knowledge. Match the task to the rows below and read those files end to end before you design, write, review, or analyze the code. Reading the row is not reading the reference; guessing from the codebase is how the wrong convention gets shipped.
| Task |
Reference |
| Models, validations, associations, business logic |
references/model.md |
| Custom validators, validation rules reused across models |
references/validator.md |
| Error handling, rescue boundaries, reporting, retries |
references/error-handling.md |
| Controllers, CRUD actions |
references/crud.md |
Routes, config/routes.rb, resource mapping |
references/routes.md |
| Concerns, shared behavior |
references/concerns.md |
| State tracking (not booleans) |
references/state-records.md |
| Authentication, authorization, sessions, IDOR scoping |
references/auth.md |
| Database migrations |
references/migration.md |
| Minitest, fixtures, testing |
references/test.md |
| Views, ERB, partials, helpers, presentation logic |
references/view.md |
| Turbo Frames, Turbo Streams, real-time |
references/turbo.md |
| Stimulus controllers, JS sprinkles |
references/stimulus.md |
| Background jobs, Solid Queue |
references/jobs.md |
| Concurrency, fibers, Async, external I/O |
references/async.md |
| Mailers, email notifications |
references/mailer.md |
| Fragment caching, HTTP caching |
references/caching.md |
| REST API, JSON responses |
references/api.md |
| Multi-tenancy, account scoping |
references/multi-tenant.md |
| Event tracking, activity logs |
references/events.md |
| Webhooks (inbound/outbound), inbox, idempotency |
references/webhooks.md |
| Code review, consistency check |
references/review.md |
| HTTP clients, external APIs, Faraday |
references/http-client.md |
| Logging, log messages, Rails.logger |
references/logging.md |
Coding style
These are cross-cutting rules: they apply to every file, regardless of area. They do not replace the references. For anything area-specific (models, controllers, jobs, views, tests, …) you MUST ALWAYS load the matching reference from the table above before writing or reviewing the code.
Conditionals
Use an expanded if/else over a value-returning guard clause. A guard clause at the top of a method is fine when the body is non-trivial.
# Don't: value-returning guard clause for a simple branch
def status_label
return "closed" if closed?
"open"
end
# Do: expanded if/else
def status_label
if closed?
"closed"
else
"open"
end
end
Method order
Class methods, then public (with initialize first), then private. Order methods vertically by invocation: a caller sits above its callees.
# Don't: callee above its caller, public after private
class Signup
def create_member = Member.create!(email:)
def call = create_member
end
# Do: class method, then the caller, then its callees
class Signup
def self.call(...) = new(...).call
def call = create_member
private
def create_member = Member.create!(email:)
end
Visibility
No blank line after private; indent the methods beneath it. A module of only private methods marks private at the top with a blank line after, not indented.
# Don't: blank line after private, methods not indented
class Card
private
def closure_exists? = closure.present?
end
# Do: no blank line, indented under private
class Card
private
def closure_exists? = closure.present?
end
Bang methods
Use ! only when a non-bang counterpart exists (like save/save!). Never add ! just to flag a destructive or important action.
# Don't: unpaired bang used to signal "this is destructive"
def revoke! = update!(revoked_at: Time.current)
# Do: plain domain verb; the ! belongs to the paired persistence call
def revoke = update!(revoked_at: Time.current)
Method naming
Public methods are domain verbs. When a verb collides with a scope, predicate, or core method (Kernel#fail), prefix with mark_ (no bang): mark_failed. Class and concept naming live in references/model.md.
# Don't: mark_ prefix when the plain verb is free
def mark_published = update!(published_at: Time.current)
# Do: plain verb; reserve mark_ for a real collision (fail -> Kernel#fail)
def publish = update!(published_at: Time.current)
def mark_failed = update!(failed_at: Time.current)
Comments
Default to none. Most comments are noise: the code and naming should carry the meaning.
Add one only when the code can't carry it:
- The path or code can't make the problem clear.
- The model's language is ambiguous and a note clarifies where it sits in the domain.
Don't:
- Restate what the code already says.
- Section code (e.g.
# ----- some_method ----- banners in tests).
When a comment earns its place:
- Plain English, always.
- Concise.
- No LLM-slop vocabulary.
- Use a list when it reads clearer than prose.
# Don't: restates what the code already says; section banner
# increment the attempts counter
attempts += 1
# ----- private helpers -----
# Do: explains the non-obvious why
# Circle returns 422 on duplicate emails, so we reconcile instead of recreating.
reconcile_member(email)
Errors
Don't swallow errors. Make the failure accessible to the caller, usually by recording it on a returned object rather than logging and returning false. Full handling conventions (record vs raise, reporting, wrapping, retries) live in references/error-handling.md.
# Don't: swallow the error; the caller can't tell it failed
def provision_circle
circle_client.create_community_member(...)
rescue Circle::AdminClient::ApiError
false
end
# Do: record the failure on the returned object
def provision_circle
circle_client.create_community_member(...)
circle_access.mark_successful(external_id: response.dig(:community_member, :id))
rescue Circle::AdminClient::ApiError => e
circle_access.mark_failed(error: e.message) # caller checks access.failed?
end
Sources
These conventions are adapted from, and may diverge from, these reference apps:
1---2name: rails-dev3description: Opinionated Rails conventions: rich models, concerns, CRUD-everything, state-as-records, minimal dependencies, Minitest with fixtures. Load this skill BEFORE any code-level thinking, not only before editing a file. It is required the moment a task touches Rails code in ANY way: designing or even just discussing a data model, schema, migration, entity, association, field, validation, class, or method name; writing, planning, reviewing, analyzing, testing, debugging, or refactoring; or proposing any model, table, column, route, or code snippet inline in chat. If you are about to name a model or sketch a column you are already in scope, even in an exploratory back-and-forth where no file is written yet. Do not let a "we're just discussing" framing defer it. Do NOT use for non-Rails backends, NestJS, or general architecture (use nestjs-modular-monolith or coding-guidelines).4---5
6# Rails Conventions
7
8## Core Philosophy
9
10- **Rich models** - Business logic lives in models, not service objects
11- **Everything is CRUD** - New resource over new action (`resource :closure` not `post :close`)
12- **State as records** - `Closure` model instead of `closed: boolean`
13- **Concerns for composition** - `Closeable`, `Watchable`, `Commentable`
14- **Explicit over clever** - Inline until repetition is real; an abstraction earns its place, it isn't built on speculation
15- **Small interfaces** - No public method without a caller
16- **Let it crash** - Bang methods (`create!`), handle failures at the boundary, not by pre-guarding (`references/error-handling.md`)
17- **Invariants in the schema** - Hard rules (presence, uniqueness, ranges) are NOT NULL / unique / check constraints; validations are for user-facing messages, not the source of truth. References stay soft: no foreign keys, integrity at the model layer
18- **Minimal dependencies** - Build it yourself before reaching for gems. No Devise, Pundit, RSpec, FactoryBot, ViewComponent, service/form objects, or decorators
19- **Database-backed** - Solid Queue/Cache/Cable, no Redis
20- **Test coverage** - Maintain roughly 1:1 test ratio (1 line test per line of code)
21
22## Reference Selection
23
24This table is an index, not the content. The conventions live in the reference files, not in this table, the codebase, or general Rails knowledge. Match the task to the rows below and **read those files end to end before you design, write, review, or analyze the code**. Reading the row is not reading the reference; guessing from the codebase is how the wrong convention gets shipped.
25
26| Task | Reference |
27|------|-----------|
28| Models, validations, associations, business logic | `references/model.md` |
29| Custom validators, validation rules reused across models | `references/validator.md` |
30| Error handling, rescue boundaries, reporting, retries | `references/error-handling.md` |
31| Controllers, CRUD actions | `references/crud.md` |
32| Routes, `config/routes.rb`, resource mapping | `references/routes.md` |
33| Concerns, shared behavior | `references/concerns.md` |
34| State tracking (not booleans) | `references/state-records.md` |
35| Authentication, authorization, sessions, IDOR scoping | `references/auth.md` |
36| Database migrations | `references/migration.md` |
37| Minitest, fixtures, testing | `references/test.md` |
38| Views, ERB, partials, helpers, presentation logic | `references/view.md` |
39| Turbo Frames, Turbo Streams, real-time | `references/turbo.md` |
40| Stimulus controllers, JS sprinkles | `references/stimulus.md` |
41| Background jobs, Solid Queue | `references/jobs.md` |
42| Concurrency, fibers, Async, external I/O | `references/async.md` |
43| Mailers, email notifications | `references/mailer.md` |
44| Fragment caching, HTTP caching | `references/caching.md` |
45| REST API, JSON responses | `references/api.md` |
46| Multi-tenancy, account scoping | `references/multi-tenant.md` |
47| Event tracking, activity logs | `references/events.md` |
48| Webhooks (inbound/outbound), inbox, idempotency | `references/webhooks.md` |
49| Code review, consistency check | `references/review.md` |
50| HTTP clients, external APIs, Faraday | `references/http-client.md` |
51| Logging, log messages, Rails.logger | `references/logging.md` |
52
53## Coding style
54
55These are cross-cutting rules: they apply to every file, regardless of area. They do **not** replace the references. For anything area-specific (models, controllers, jobs, views, tests, …) you MUST ALWAYS load the matching reference from the table above before writing or reviewing the code.
56
57### Conditionals
58
59Use an expanded `if/else` over a value-returning guard clause. A guard clause at the top of a method is fine when the body is non-trivial.
60
61```ruby
62# Don't: value-returning guard clause for a simple branch
63def status_label
64 return "closed" if closed?
65 "open"
66end
67
68# Do: expanded if/else
69def status_label
70 if closed?
71 "closed"
72 else
73 "open"
74 end
75end
76```
77
78### Method order
79
80Class methods, then public (with `initialize` first), then private. Order methods vertically by invocation: a caller sits above its callees.
81
82```ruby
83# Don't: callee above its caller, public after private
84class Signup
85 def create_member = Member.create!(email:)
86 def call = create_member
87end
88
89# Do: class method, then the caller, then its callees
90class Signup
91 def self.call(...) = new(...).call
92
93 def call = create_member
94
95 private
96 def create_member = Member.create!(email:)
97end
98```
99
100### Visibility
101
102No blank line after `private`; indent the methods beneath it. A module of only private methods marks `private` at the top with a blank line after, not indented.
103
104```ruby
105# Don't: blank line after private, methods not indented
106class Card
107 private
108
109 def closure_exists? = closure.present?
110end
111
112# Do: no blank line, indented under private
113class Card
114 private
115 def closure_exists? = closure.present?
116end
117```
118
119### Bang methods
120
121Use `!` only when a non-bang counterpart exists (like `save`/`save!`). Never add `!` just to flag a destructive or important action.
122
123```ruby
124# Don't: unpaired bang used to signal "this is destructive"
125def revoke! = update!(revoked_at: Time.current)
126
127# Do: plain domain verb; the ! belongs to the paired persistence call
128def revoke = update!(revoked_at: Time.current)
129```
130
131### Method naming
132
133Public methods are domain verbs. When a verb collides with a scope, predicate, or core method (`Kernel#fail`), prefix with `mark_` (no bang): `mark_failed`. Class and concept naming live in `references/model.md`.
134
135```ruby
136# Don't: mark_ prefix when the plain verb is free
137def mark_published = update!(published_at: Time.current)
138
139# Do: plain verb; reserve mark_ for a real collision (fail -> Kernel#fail)
140def publish = update!(published_at: Time.current)
141def mark_failed = update!(failed_at: Time.current)
142```
143
144### Comments
145
146Default to none. Most comments are noise: the code and naming should carry the meaning.
147
148Add one only when the code can't carry it:
149
150- The path or code can't make the problem clear.
151- The model's language is ambiguous and a note clarifies where it sits in the domain.
152
153Don't:
154
155- Restate what the code already says.
156- Section code (e.g. `# ----- some_method -----` banners in tests).
157
158When a comment earns its place:
159
160- Plain English, always.
161- Concise.
162- No LLM-slop vocabulary.
163- Use a list when it reads clearer than prose.
164
165```ruby
166# Don't: restates what the code already says; section banner
167# increment the attempts counter
168attempts += 1
169
170# ----- private helpers -----
171
172# Do: explains the non-obvious why
173# Circle returns 422 on duplicate emails, so we reconcile instead of recreating.
174reconcile_member(email)
175```
176
177### Errors
178
179Don't swallow errors. Make the failure accessible to the caller, usually by recording it on a returned object rather than logging and returning `false`. Full handling conventions (record vs raise, reporting, wrapping, retries) live in `references/error-handling.md`.
180
181```ruby
182# Don't: swallow the error; the caller can't tell it failed
183def provision_circle
184 circle_client.create_community_member(...)
185rescue Circle::AdminClient::ApiError
186 false
187end
188
189# Do: record the failure on the returned object
190def provision_circle
191 circle_client.create_community_member(...)
192 circle_access.mark_successful(external_id: response.dig(:community_member, :id))
193rescue Circle::AdminClient::ApiError => e
194 circle_access.mark_failed(error: e.message) # caller checks access.failed?
195end
196```
197
198## Sources
199
200These conventions are adapted from, and may diverge from, these reference apps:
201
202- [basecamp/fizzy](https://github.com/basecamp/fizzy)
203- [railswhey/app](https://github.com/railswhey/app)
204