Rails 8 Apps skill for Codex

Done well means: the feature fits Rails conventions (resourceful routes, fat-enough models, thin controllers), every validation that matters is also a database constraint, pages render without N+1 queries, interactivity comes from Turbo before custom JavaScript, slow work runs in jobs enqueued after commit, and bin/rails test, RuboCop and Brakeman pass.

Inspect first

• Read AGENTS.md, Gemfile/Gemfile.lock (Rails version, solid_queue, turbo-rails, stimulus-rails, importmap-rails or jsbundling), config/database.yml (separate queue/cache/cable databases in Rails 8), config/routes.rb.
• Check for bin/ci (Rails 8.1 local CI, defined in config/ci.rb); if present it is the definition of “all checks”.
• bin/rails routes -g orders and bin/rails db:migrate:status before changing anything.

Generators, then trim

bin/rails generate model Order customer:references status:string total_cents:integer
bin/rails generate controller Orders index show new create
bin/rails generate authentication        # Rails 8: User, Session, Authentication concern

Generators are a starting point. Remove unused actions, views and tests they create; never commit scaffold code you have not read.

Routes and controllers

# config/routes.rb
resources :orders, only: %i[index show new create] do
  resource :cancellation, only: :create      # POST /orders/:order_id/cancellation
end

Model verbs as nested singular resources (cancellation) instead of custom member actions; keeps controllers to the seven REST actions.

class OrdersController < ApplicationController
  rate_limit to: 10, within: 1.minute, only: :create

  def index
    @orders = Current.user.orders.includes(:line_items).order(created_at: :desc).limit(50)
  end

  def show
    @order = Current.user.orders.find(params.expect(:id))
  end

  def create
    @order = Current.user.orders.build(order_params)
    if @order.save
      redirect_to @order, notice: "Order placed"
    else
      render :new, status: :unprocessable_entity
    end
  end

  private

  def order_params
    params.expect(order: [:shipping_address, :notes, line_items_attributes: [[:sku, :qty]]])
  end
end

• params.expect (Rails 8) replaces require(...).permit(...) and returns 400 instead of raising 500 when the shape is wrong. Arrays of hashes use double brackets.
• Always find through the association (Current.user.orders.find), never Order.find(params[:id]) for user-owned data.
• Render failed forms with status: :unprocessable_entity (422) or Turbo will not replace the page.
• With the authentication generator, controllers require login by default; opt out with allow_unauthenticated_access only: %i[index].

Models

class Order < ApplicationRecord
  belongs_to :customer, class_name: "User"
  has_many :line_items, dependent: :destroy
  accepts_nested_attributes_for :line_items

  enum :status, { pending: "pending", paid: "paid", cancelled: "cancelled" }, default: :pending, validate: true
  normalizes :shipping_address, with: ->(a) { a.strip }

  validates :total_cents, numericality: { only_integer: true, greater_than_or_equal_to: 0 }

  after_create_commit -> { OrderMailer.with(order: self).placed.deliver_later }
end

class CreateOrders < ActiveRecord::Migration[8.0]
  def change
    create_table :orders do |t|
      t.references :customer, null: false, foreign_key: { to_table: :users }
      t.string :status, null: false, default: "pending"
      t.integer :total_cents, null: false, default: 0
      t.timestamps
    end
    add_index :orders, [:customer_id, :created_at]
    add_check_constraint :orders, "total_cents >= 0", name: "orders_total_nonnegative"
  end
end

• Uniqueness validations race; back them with a unique index.
• Side effects (mail, jobs, broadcasts) go in after_commit/after_create_commit, not after_save, so they never fire for rolled-back transactions.
• String-backed enums survive reordering; integer enums break if values shift.
• Large-table migrations under load: add indexes with algorithm: :concurrently and disable_ddl_transaction! on PostgreSQL; the strong_migrations gem catches unsafe operations. See $zero-downtime-migrations.

Queries

• Eager load what views render: includes(:line_items); preload / eager_load when you need to force the strategy.
• Turn on strict_loading per association or config.active_record.strict_loading_by_default in development and test to make lazy loads raise.
• Batch work with find_each/in_batches, never .all.each on big tables.
• Deeper tuning: $active-record-performance.

Hotwire

Need	Tool
Update part of a page from a link or form	Turbo Frame (turbo_frame_tag)
Several regions change after a form submit	Turbo Stream response (create.turbo_stream.erb)
Live updates pushed to other users	broadcasts_refreshes + turbo_stream_from, or targeted broadcasts
Whole page refresh without losing scroll	Turbo 8 morphing: turbo_refreshes_with method: :morph, scroll: :preserve in the layout
Small client behaviour (toggle, copy, debounce)	Stimulus controller

<%# app/views/orders/show.html.erb %>
<%= turbo_stream_from @order %>
<%= turbo_frame_tag dom_id(@order, :status) do %>
  <%= render "orders/status", order: @order %>
<% end %>

class Order < ApplicationRecord
  broadcasts_refreshes      # pages subscribed with turbo_stream_from @order refresh (morph) on change
end

Broadcasts run over Action Cable (Solid Cable by default in Rails 8). Authorize stream subscriptions: turbo_stream_from uses signed stream names, so only render it for users allowed to see the record.

Jobs with Solid Queue

class SyncOrderJob < ApplicationJob
  queue_as :default
  retry_on Net::OpenTimeout, wait: :polynomially_longer, attempts: 5
  discard_on ActiveJob::DeserializationError

  def perform(order)
    ExternalErp.sync(order)   # must be idempotent; jobs can run more than once
  end
end

• Rails 8 sets config.active_job.queue_adapter = :solid_queue in production, backed by the queue database. Run workers with bin/jobs, or inside Puma via plugin :solid_queue (enabled with SOLID_QUEUE_IN_PUMA) for small deployments.
• Recurring tasks live in config/recurring.yml.
• perform_later inside a transaction may enqueue before commit on other adapters; Solid Queue in the same database is transactional, but in a separate queue database it is not. Enqueue from after_commit callbacks to be safe.
• Mission Control Jobs (mission_control-jobs gem) gives a UI for failed jobs; mount it behind admin auth.

Testing

bin/rails test                     # models, controllers, integration
bin/rails test:system              # browser tests, if the app keeps them
bin/rubocop
bin/brakeman --no-pager

Integration tests (ActionDispatch::IntegrationTest) for each controller path: success, validation failure (422), another user’s record (404), unauthenticated (redirect to sign in). Use assert_enqueued_with(job: SyncOrderJob) for jobs and assert_turbo_stream action: :replace from turbo-rails test helpers for stream responses.

Deploying

Rails 8 ships Kamal 2 config (config/deploy.yml) and Thruster in the Dockerfile. bin/kamal deploy pushes to production servers: show the user the target and wait for explicit confirmation before running it. Secrets come from .kamal/secrets and bin/rails credentials:edit; never commit config/master.key.

Upgrading to Rails 8

1. Get on the latest 7.2 patch with zero deprecation warnings first.
2. Bump rails, run bin/rails app:update, review each config diff instead of accepting all.
3. Move config.load_defaults up one version at a time using new_framework_defaults_8_0.rb.
4. Solid Queue, Cache and Cable, Propshaft and the auth generator are optional for upgraded apps; adopt them in separate changes.

Verification

Run bin/ci if it exists; otherwise bin/rails db:migrate (and db:rollback + db:migrate once to prove reversibility), bin/rails test, bin/rubocop and bin/brakeman. Open the page in bin/dev and watch the log for N+1 warnings from strict_loading.

Output template

## Rails change: <summary>
- Routes: <resources added>
- Models/migrations: <tables, constraints, indexes>
- Hotwire: <frames/streams/broadcasts>
- Jobs: <job, queue, retry policy>
- Checks: tests, rubocop, brakeman, migration rollback