Rails Active Record 8.0

Apply the Ruby on Rails 8.0 prompt first. These rules cover Active Record 8.0 and were checked against 8.0.5.1, which requires Ruby 3.2.0 or newer; the included Rails pack selects the Ruby 3.4 baseline.

Query construction and bounded reads

• Construct where, having, and find_by conditions yourself, using attribute hashes or placeholders such as where("email = ?", email). Never pass a request-supplied string or entire parameter object as the condition.
• Keep SQL structure in order, group, select, pluck, joins, and from server-owned. Review Arel.sql, custom Arel nodes, find_by_sql, and connection-level query APIs as SQL escape hatches; bind values and map selectable identifiers or expressions to fixed alternatives.
• Escape literal search text with sanitize_sql_like before adding intentional % wildcards to a bound LIKE value; quoting alone does not neutralize % or _ pattern matching.
• Preserve mandatory predicates through merge, or, subqueries, eager loading, and association traversal. Review unscoped, unscope, except, and rewhere; do not call invert_where on a relation containing tenant or visibility predicates, because it negates the accumulated conditions.
• Fail closed when an authorization predicate cannot be built: raise or return none. where(nil), where({}), and other blank conditions leave the relation unchanged.
• Do not rely on an ordinary default_scope to constrain instance updates or deletes; all_queries: true is needed to apply its WHERE predicates to those operations. Even that scope can be