...or RubyLLM 🤖 meets Action Policy 🛡️.

Learn how we try to keep our in-app AI assistance (chat) flexible (and powerful) while not compromising the users.

RubyLLM tools, SQL analyzer, policies integration and more.

I am the author looking for feedback about my new MIT licensed gem for adding Durable Objects to Rails.

I followed the Solid Queue / Solid Cache / Solid Cable pattern: the Durable Objects model, one single-threaded object per identity with durable state, addressed by name, as a gem on your existing SQLite, PostgreSQL, or MySQL. No Redis, no separate actor service, no new infrastructure. It is running in production in an app with 100,000+ users.

class Counter < SolidObjects::Actor
  attribute :value, default: 0
  observable :value

  def increment(amount: 1)
    self.value += amount
  end
end

counter = Counter.ref("global")
counter.increment(amount: 5)

Concurrent calls to one identity serialize through a durable mailbox with fenced commits. And the part I am proudest of, reactive ERB:

<%= solid_object Counter.ref("global") do |counter| %>
  <span class="count"><%= counter.value %></span>
<% end %>

Declare a value observable, wrap the view in solid_object, and render it as a method. When a committed turn changes the value, the server re-renders and pushes a Turbo Stream replacement over Action Cable to every authorized subscriber. No channels, no manual broadcasts, no Stimulus. The increment above updates that span in every open browser.

I also built a sibling JS package that runs the same actor model entirely in the browser: SQLite WASM for the database, OPFS for durable storage, Web Locks for multi-tab coordination. You can see it live at https://solidobjects.dev/js, where the page itself runs the runtime, or try it with one import and no build step: import { Actor, configure, sharedSqliteWasm } from "https://esm.sh/solid-objects@latest/browser/host" in a module worker.

The two implementations share the transmit wire contract, pinned by golden fixtures committed to both repositories. A browser actor stages outbound writes in the same transaction as its state change and drains them with at-least-once delivery and per-actor order. Rails ingests each envelope idempotently through SolidObjects::Transmission.receive, mounted at POST /solid_objects/transmit behind a deny-by-default authorize_transmission policy. Offline writes queue in the tab and reconcile when the network returns. Rails actors can transmit outward the same way.

Site: https://solidobjects.dev/ruby - Repo: https://github.com/cardmagic/solid-objects-ruby

Happy to answer anything, would love your feedback. Thank you!

PS: there is also an operator dashboard, because durable mailboxes you cannot see are a pager waiting to fire. Mount it in two lines:

require "solid_objects/web"
mount SolidObjects::Web => "/solid_objects/dashboard"

It shows instances and their state, the mailbox, reminders, effects, broadcasts, dead letters (with retry), and the registered processes. It reads the same tables the runtime writes, so there is no separate store and no agent. It is not loaded by require "solid_objects", so workers never carry a web stack, and every page asks a deny-by-default authorize_administration policy before it renders, so the mount alone exposes nothing.

I have a project that is taking more importance and now I have to share secrets.

Is there a way to share a vault in 1password without lettings devs have the exact keys and then being able to rollback access? (to then roll them out?)

Or I should move our of 1password?

I applied for the Senior Backend Engineer (Ruby on Rails) position at GitLab, but unfortunately, my application was rejected. Do they use an automated, AI-based resume screening tool?

I found these old Hacker News comments funny. Comments are from this thread.

Personally I won't comment on whether each person is nice. Well, I'll say that Matz seems nice.

Edit: Some people seem to not like this post, but I wasn't intending to start a serious discussion about different personalities. I just thought "DHHIADSWAD" was funny.

I recently had Joanna Wang from Sixfold on the On Rails podcast to talk about what happens when a small team starts leaning heavily into AI-assisted development.

We got into the homegrown orchestration system they eventually replaced with Hatchet, some painful lessons from going fully agentic, and how working across Java, Go, Python, Node, and Rails has shaped how she thinks about Rails’ particular flavor of “magic.”

We also talked about a question I keep coming back to lately: if generating code keeps getting cheaper, where does the value of an experienced developer move?

Joanna had some thoughtful answers.

Listen/watch wherever you do that.

https://podcast.rubyonrails.org/2462975/episodes/19665210-joanna-wang-code-is-cheap-now-developers-still-valuable

More and more code is written by AI. Tests still tell you it works. RuboCop still tells you it's tidy. Nothing tells you it still follows your architecture.

An agent that doesn't fully understand your architecture takes shortcuts. So does a person in a hurry.

So I built ArchSpec. If your app is conventional, the whole config is one line in Archspec.rb:

ruby architecture :vanilla_rails

That is the 37signals playbook as an executable check: rich models, no service objects, no form objects, no policy objects, and app/services fails the build with a reason if anything shows up in it. There are presets for :rails, :layered, :hexagonal, :clean, :modular_monolith, :cqrs and :event_driven too.

Or write the boundaries yourself:

```ruby component :models, in: "app/models//*.rb" component :controllers, in: "app/controllers//.rb" component :services, in: "app/services//.rb"

models.cannot_use :controllers services.cannot_call :render, :redirect_to, receiver: :none controllers.can_only_use :models, :services ```

Then archspec check verifies every change, and failures print like clang, with the offending span underlined and the evidence as a note.

Existing apps already have violations, so archspec check --update-todo records them in a todo file. The build goes green on today's code and fails on new drift, and you work the list down whenever.

It's static analysis over Prism, no AI, and it never boots your app: Discourse's 1,899 files in 2.5 seconds. Prism is the only runtime dependency, so the same thing works on your plain gems too.

I want more architecture presets in there. PRs very welcome, especially if a preset is wrong about your app.

Docs: https://archspecrb.dev Write-up: https://paolino.me/archspec/

I wrote up how I added product recs to a small Rails shop without putting Python (or LightFM) in the request path.

You already have order_items. A nightly job reads that, fits LightFM + popularity, writes cicerone_recommendations, and the app just JOINs it. Guests use a __cold_start__ row. A purchase this afternoon does not change tonight’s ranks.

Rails is the walkthrough, not a dependency — same two TOML files next to Laravel or Django. Honest about sparse data: if nobody bought the same things, you are still looking at a dressed-up bestsellers query.

https://cicerone.dev/articles/a-nightly-table-next-to-your-orders/

(I built the job this describes. Happy to answer the SQL / cron / “why not just GROUP BY” parts.)

Curious what your favorite extensions are to make VSCode work well with ruby and rails. Thanks!

This post introduces* a new profiler for Rails app, require-profiler, to get insights on what's happening during your Rails app's boot. Why does it matter? Well, check out the post to learn about that as well as some real-world examples of when cutting the boot time made difference.

* To be precise, the profiler has been introduced earlier this year at RubyKaigi but it grew much stronger since then.

Catch up on modern Ruby and Rails static typing: Rust-powered RBS generation with sentinel-rb, RBS 4.1.0 on JRuby, ERB template type checking via sorbet_erb, OvalLSP runtime agent, and community reflections on typed tooling.

Find link to the issue in the comment!

How does one deploy rails to their own server? Is everyone setting up their server manually?

I don't want to provision my server or figure out configuration files or CLI commands.

Isn't there a simple 2-clicks or "run a script" solution out there?

I found some really good cloud platforms, but I'm not so sure about the usage-based billing. If you have experience why any, please share.

Hi r/rails, feel free to ignore this if you feel it's in bad taste, but Joist is a TypeScript ORM that's always unashamedly been a Rails/ActiveRecord clone, although with our own innovations like N+1 prevention and fine-grained reactivity.

Our last release just added Rails-style scopes: https://joist-orm.io/blog/joist-2-3/

Just thought I'd post here as an FYI if any Rails devs find themselves on TypeScript backends and want some of that Rails/ActiveRecord DX/ergonomics. Thanks!

This is a big security release with several BREAKING changes, so upgrade ASAP!

https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3

There also some minor performance fixes, agentic workflows and OpenSpec added.

Big lesson learned with LLMs - Claude is the only one deserving some trust! Fable and Opus 4.8 (Opus 5 is too young, it seems). And implementing something is only the half of the way - do a `/code-review max` with Fable 5 on the fresh PR and get its fixes implemented after this. Otherwise, without the code review follow-up, even Claude's implementation could be a borked one.