Codex Setup for Ruby on Rails
Rules file: AGENTS.md
Rails has twenty years of accumulated idioms in training data, and a large share of them were removed years ago, so an agent's confident answer is often a Rails 4 answer. The frontend story in particular forked several times, from Sprockets to Webpacker to importmaps and Hotwire, and picking the wrong one produces code that never loads. An agent also needs to understand that the schema file is generated output and that ActiveRecord callbacks are the default place agents hide side effects.
Configuring Codex for Ruby on Rails
- → List the exact rails and bin/rails commands you want used for generators, so Codex scaffolds through Rails rather than writing files by hand.
- → State that bundle exec is required, since a system gem version mismatch produces confusing failures Codex will try to fix in the wrong place.
- → Describe your service object convention if you have one, because Rails itself provides no location and Codex will invent one otherwise.
Building AGENTS.md
There is no ready-made Ruby on Rails template yet. The generator produces one from your project type, with the commands an agent may run and the files it must not touch.
Open the generatorRule these out for Ruby on Rails
These are the failures that repeat across sessions, so each one belongs in AGENTS.md.
Bypassing strong parameters with permit!
When a nested attribute fails to save, the shortest fix an agent finds is params.require(:user).permit! or passing params directly to update, which re-opens mass assignment across every column including role and admin flags. It always makes the immediate error disappear. Add to your rules file: 'Strong parameter methods list permitted keys explicitly. permit! is never acceptable, and nested attributes are permitted by naming their keys.'
Interpolating params into a where clause
Agents write where("name LIKE '%#{params[:q]}%'") because string interpolation is the natural Ruby reflex and the result reads fine. That is a SQL injection hole, and it appears most often in search and sort code where the input is user supplied by definition. Write: 'ActiveRecord conditions always use hash conditions or positional placeholders. Never interpolate a variable into a SQL string, including ORDER BY clauses built from params.'
Preloading omitted before iterating associations
A controller returns Article.all and the view renders article.author.name plus article.comments.size, quietly issuing several queries per article. Rails makes this so ergonomic that it survives code review. Add: 'Controllers pass fully preloaded relations to views using includes or preload. Add the Bullet gem in development and treat its warnings as failures rather than logging noise.'
Piling side effects into model callbacks
Asked to notify a user after a record is created, agents add an after_create that sends mail, charges a card, or posts to a webhook. It then fires from seeds, from every factory in the test suite, and from console fixes, and it cannot be skipped without skipping validations too. Write: 'Callbacks may set derived attributes on the same record only. Notifications, payments, and outbound requests are dispatched explicitly from a service object or ActiveJob in the controller or job that owns the flow.'
Hand-editing db/schema.rb
When schema.rb does not match what an agent expects, it edits the file directly instead of writing a migration, which produces a schema that no migration can reproduce and a version number that lies. The app boots, so nothing complains until the next deploy. Add: 'db/schema.rb is generated. All schema changes go through rails generate migration, and schema.rb is only ever updated as a side effect of running migrations.'
Reaching for removed Rails idioms
before_filter, attr_accessible, render :text, and Webpacker configuration all still appear in agent output, and each was removed or replaced several major versions ago. The failure mode ranges from a deprecation to a NoMethodError at boot. State your versions: 'Rails 7 or later on Ruby 3.x, using importmaps and Hotwire. Use before_action, strong parameters, and render plain. Never add Webpacker, attr_accessible, or before_filter.'
Skills that pair with this setup
docx
Create, edit, analyze Word docs with tracked changes, comments, formatting.
Master Claude for Legal
Skill pack for legal teams. NDA triage, multi-party version diff, citation verifier, meeting brief, and the Friday-newsletter status synthesis pattern. Includes 10 reference docs (privilege, verification, long documents, practice areas) and 3 firm templates. Built from the public Anthropic Claude for Legal Teams webinar dataset.
Connect
Connect Claude to any app. Send emails, create issues, post messages, update databases - take real actions across Gmail, Slack, GitHub, Notion, and 1000+ services.
great_cto
Claude Code plugin: 7 specialised subagents (tech-lead, senior-dev, qa-engineer, security-officer, devops, l3-support, project-auditor) orchestrating a full SDLC pipeline — architecture, TDD, 12-angle code review, QA, security audit, deploy. 11 project archetypes auto-detected, 13 compliance frameworks (GDPR/PCI-DSS/HIPAA/SOC2/ISO 27001), self-improving knowledge layer that learns from every incident.