Roundhouse

Roundhouse does not implement Rails. It recognizes the Rails an app uses — the conventions, the DSL, the helpers — and lowers each recognized form to target-neutral IR that every emitter consumes. So "is X supported?" has two parts: does the analyzer recognize X, and does each target have a lowering and a runtime for it. This page is the feature-level answer as of this snapshot; the per-app answer is the tools:

• roundhouse check --continue (check.md) — the survey report lists every construct the analyzer did not recognize in your app, and the gem census lists every gem it does not model.
• the MCP wont_lower tool (mcp.md) — for a named target, the constructs in your app that have no lowering to it.

Those are authoritative and current; this page is the map.

Two tiers

Coverage is proven by apps, not by feature lists. Two apps define the tiers.

The blog (fixtures/real-blog, the Rails 8 scaffold with articles, comments, nested routes, validations, Turbo Streams, Action Cable, Tailwind, JSON endpoints) is what every server target passes the DOM-equivalence gate against on every push. What the blog uses is supported everywhere.

Campfire (Basecamp's chat product — file attachments with image variants, rich text, web push, bots and webhooks, full-text search, signed cookies and sessions, Current, fragment caching, rate limiting, ~70 routes) is what the Ruby shape — running on CRuby, and compiled by Spinel — passes the same gate against, along with Campfire's own test suite and its cable broadcasts. What Campfire uses beyond the blog is supported on those two lanes, and reaches the others as their emitters and runtimes catch up.

Active Record

SQL identifier boundary

Compiler-generated SQLite DDL, indexes, seeds and Arel/model CRUD quote physical identifiers without renaming them, including keywords, spaces, hyphens and embedded quotes. Emitted models keep table_name raw and provide the SQL spelling separately to Relation; ordinary filter/order chains on those models use it too. A dot in one physical name stays part of that name, not a new schema-qualified ingest feature. Quoting metadata does not widen the Ruby table-name declarations ingest can interpret.

This is not complete quoting of every SQL path. Association JOIN strings, nested dynamic qualifiers/column names and native adapter fallbacks remain gaps: accepted source can still generate invalid SQL there, without a new unsupported diagnostic. The compiler SQL dialect is SQLite, not PostgreSQL/MySQL. tests/sql_identifiers.rs executes synthetic SQLite and emitted CRuby cases; its other language checks prove DDL string preservation, including literal interpolation markers, not whole-project execution on every target. Native hand-written models still need SQL-ready identifiers; the Base metadata fallback does not dynamically quote arbitrary names.

The runtime typing ledger records one additional unresolved self-send in the isolated RBS probe and three additional gradual reads for raw RecordNotFound messages through Relation's existing untyped model handle. The strict fully-typed runtime gate and diagnostics are unchanged; this does not add generic class-object/Relation support to strict targets.

Action Controller

Action View

The rest of the framework

What is not lowered, anywhere

The analyzer is whole-program and static. Whatever it cannot see through at compile time it cannot type, and whatever it cannot type it does not emit:

• Metaprogramming that constructs names at runtime: send and public_send with a non-literal method name, define_method, method_missing, instance_variable_get/set, const_get, eval in any form, Class.new, and obj.extend Mod on one live object (the site — or in a test, the whole test — becomes a raise that names the construct, so the rest of the file still compiles).
• Reopening the framework: monkey-patches of Rails or core classes from initializers (Module#prepend into a framework class is recorded and skipped on Spinel), alias_method inside class << self.
• Dynamic loading: require of a file computed at runtime, autoload of things outside the app's conventions.
• Anything reached only through an unknown gem's DSL — the census tells you which.
• Ruby, not Rails: refinements, ObjectSpace, Fiber/Thread used directly by the app, binding, Method objects.

Each of these is reported by name and location in the survey report, so the answer for a given app is a list, not a guess. That includes a class-body macro in a controller that roundhouse does not recognize (Lobsters' caches_page, say): it is listed as a survey gap rather than dropped in silence, because its effect — a guard, a filter, a header — would otherwise vanish from the output with no trace.

Deliberate divergences

Some Rails behaviors are reproduced differently on purpose, because the Rails behavior depends on a runtime facility the targets don't have or because it is an accident of implementation. Each is a decision, recorded with its reasoning in the architecture docs: docs/pipeline/runtime.md §Deliberate divergences from Rails. The ones a user is most likely to meet: an unsaved record's id is 0, not nil; attribute writers do not type-cast (the column type is enforced at the boundary instead); conditional GET always answers fresh; a Turbo stream name is signed only on the Ruby-family targets (elsewhere it carries an --unsigned placeholder); the query cache replays small results only; increment! is a read-modify-write.

Anything not in that section that differs from Rails is a bug, and the compare oracle is how to demonstrate it.

Security posture

CSRF is verified on the ruby family where the app declares it — the CRuby and Spinel lanes, which is where Campfire deploys. protect_from_forgery with: :exception runs as the before_action Rails registers, at the same place in the chain, with its only: / except: / if: / unless:; skip_forgery_protection removes it. A non-GET request must carry the session's token in the authenticity_token param or the X-CSRF-Token header, and a present Origin must name the request's own host; otherwise the answer is Rails' 422. The emitted test harness turns the check off, as a generated config/environments/test.rb does.

What differs from Rails, and why:

• Tokens are not masked. Rails hands out a per-render masked token (a BREACH mitigation); the emit issues the session token itself.
• The Origin check compares hosts, not schemes. Rails compares request.base_url. The ruby family now reads X-Forwarded-Proto (absolute URLs behind a TLS proxy are https, as in Rails), but assume_ssl is not modeled, so the check still compares hosts only.
• The session and flash cookies are signed, not encrypted. Rails' cookie store encrypts the session and keeps the flash inside it; the ruby family signs the session and gives each flash message (flash_notice, flash_alert) a signed cookie of its own — the same HMAC cookies.signed uses, keyed from SECRET_KEY_BASE. A client can read them but not forge them: a cookie that does not verify reads as an empty session or no message. The session payload is not Rails' JSON either, so a migration from Rails starts every session afresh; Campfire's login rides its own signed cookie and carries over.
• An unset SECRET_KEY_BASE is generated, not fatal. Rails development keeps a generated key in tmp/local_secret.txt, and production refuses to boot without one. The ruby family generates the key on first boot and keeps it in storage/secret_key_base (mode 0600), the directory a deployment already persists for its database. Set the variable to share one key across instances, or to carry a key over from a Rails deployment.
• Rails' implicit default is not applied. Under load_defaults 5.2+, Rails protects every ActionController::Base controller even when the app never writes the macro. Here only a written protect_from_forgery with: :exception is enforced: an app that relies on the default (the blog, the Rails tutorial) is not protected on any lane. The default would put the check into every target's emit, and the strict targets have no token to check.
• with: :null_session / :reset_session and prepend: are not modeled. Such a macro is reported as a gap and not enforced.
• Action Cable's Origin check uses Rails' defaults only. On the ruby family, a /cable handshake must carry an Origin naming the request's own host (compared by host, as above), or in development any localhost port. Otherwise the answer is Rails' 404 and the app's connect never runs; a handshake with no Origin is refused, as in Rails. An app's own config.action_cable.allowed_request_origins and disable_request_forgery_protection are not read. The strict targets' sockets check no Origin.

The strict targets issue no token (form_authenticity_token is empty there) and check none: an app emitted for them is not protected against cross-site forgery. Put an unprotected app behind something you trust.

This page is docs/guide/rails-coverage.md in the repository; edits are welcome there.