# CLAUDE.md: Rails 8

## Commands
`bin/dev` · `bin/rails test` (or `bundle exec rspec`) · `bin/rails test:system` · `bin/rubocop` · `bin/brakeman` · `bin/rails db:migrate` (development only)

## Conventions
- Follow Rails defaults (the "Rails way"): RESTful resources, fat models / thin controllers, concerns for shared behavior. Use generators (`bin/rails g model`, `g controller`) for new files.
- Strong params with `params.expect(post: [:title, :body])` (Rails 8) in controllers.
- Authentication from the built-in generator (`bin/rails generate authentication`) if present: use `Current.user` and `allow_unauthenticated_access` explicitly for public actions.
- Authorization per record (scoped queries like `Current.user.posts.find(params[:id])` or the policy gem in use).
- Background jobs with Active Job on Solid Queue (`perform_later`); jobs take ids and are idempotent. Caching via Solid Cache; real-time via Turbo Streams over Solid Cable.
- Front end with Hotwire: Turbo Frames/Streams for partial updates, small Stimulus controllers for behavior. No SPA framework unless the app already has one. Assets via Propshaft + importmap (or the configured bundler).
- Avoid N+1 with `includes`; enable `strict_loading` where the project uses it.
- Migrations are reversible; add DB constraints and indexes alongside model validations.
- Credentials via `bin/rails credentials:edit`; never commit `master.key`.

## Before finishing
`bin/rubocop`, `bin/brakeman --no-pager`, and the full test suite pass. Deploys (Kamal: `bin/kamal deploy`) only when asked.