rails-best-practices-core▌
marckohlbrugge/37signals-skills · updated Jun 11, 2026
MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.
Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent.
| name | rails-best-practices-core |
| description | Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent. |
Rails Best Practices Core
Use this as the default baseline for Rails work. Distilled from 37signals codebases (Campfire, Fizzy) and DHH's review patterns.
Core Defaults
- Prefer clear, explicit code over clever abstractions. Abstractions must earn their keep; if you can't point to 3+ variations that need it, inline it.
- Keep controllers thin and put domain behavior in models.
- Prefer Rails conventions and built-ins before adding gems.
- Model state and behavior with domain concepts, not ad-hoc flags.
- Scope tenant/user data through ownership boundaries.
- Favor database constraints for hard invariants; only validate in AR when you need user-facing error messages.
- Keep interfaces small; don't add public methods that aren't used anywhere.
- Prefer write-time computation over expensive read-time composition (counter caches, delegated types, precomputed roll-ups,
dependent: :delete_allwhen no callbacks needed). - Use
params.expect(...)for strong params in modern Rails. - Let it crash: bang methods (
create!), handle exceptions at boundaries. Only use!when a non-bang counterpart exists. - Fix root causes, not symptoms (e.g.
enqueue_after_transaction_commitover retry logic for races). - Ship tests in the same PR as behavior changes.
Modeling Patterns
- State as records, not booleans. Instead of
closed: boolean, create aClosurerecord withcreatorand timestamps. You get who/when for free, and scoping is trivial:
has_one :closure, dependent: :destroy
scope :closed, -> { joins(:closure) }
scope :open, -> { where.missing(:closure) }
- Slice large models into concerns named for capability (
Closeable,Watchable,Assignable), each self-contained (associations + scopes + methods), ~50-150 lines, cohesive. Prefer nested modules under the model's namespace (Card::Closeableinapp/models/card/closeable.rb) for domain slices; reserveapp/models/concerns/for genuinely cross-model behavior. Never extract concerns containing only private methods. - POROs live in
app/models/, notapp/services/: presentation objects (Event::Description), complex operations (SystemCommenter), view-context bundles (User::Filtering). They're model-adjacent, not controller-adjacent. - Default values via lambdas:
belongs_to :creator, class_name: "User", default: -> { Current.user };belongs_to :account, default: -> { board.account }. - Current attributes for request context (
Current.user,Current.account), with cascading setters (assigningsessionresolvesidentity, which resolvesuserfor the account). - Callbacks for setup/cleanup, not business logic. Keep callback counts low.
- Rails shortcuts to reach for:
normalizes(data cleanup before validation),store_accessor(JSON columns),delegated_type(heterogeneous collections),generates_token_for(expiring signed tokens), string enums viaenum :status, %w[drafted published].index_by(&:itself),after_save_commit,touch: truechains for cache invalidation,delegate. - Association extensions for bulk domain operations: define
grant_to/reviseon thehas_manyproxy; useinsert_allfor bulk creates anddependent: :delete_allon join tables with no callbacks. - Human-friendly URLs: override
to_paramwith a per-tenantnumberrather than exposing raw IDs/UUIDs.
Naming
- Spend time on names — naming is design.
ClosurebeatsCardClose;MentionbeatsUserReference. - Positive names:
activenotnot_deleted,visiblenotnot_hidden. - Semantic associations named for role:
belongs_to :creator, class_name: "User"notbelongs_to :user. - Domain-driven over technical:
quota.depleted?notquota.over_limit?. - Business-focused scopes:
:active,:unassigned,:golden— not SQL-ish:without_pop. - Consistent domain language: don't mix
source/resource/containerfor one concept.
REST & Routing
- Everything is CRUD: turn verbs into nouns. Close →
resource :closure(POST closes, DELETE reopens); publish →resource :publication. No custom member actions. - Singular
resourcefor one-per-parent state;scope module:to group nested controllers (Cards::ClosuresController); shallow nesting for deep hierarchies. - Resource-scoping controller concerns (
CardScopedsets@cardviaCurrent.user.accessible_cards.find_by!(...)) shared across nested controllers, including shared Turbo render helpers. resolve "Comment"for polymorphic URL generation to the parent with an anchor.- Same controllers serve HTML/Turbo/JSON via
respond_to— no separate API namespace.
Authorization
- No Pundit/CanCanCan: simple predicate methods on models (
card.editable_by?(user),user.can_administer_board?(board)). - Controllers check (
head :forbidden unless ...), models define what the permission means. - Declarative controller macros for auth posture:
allow_unauthenticated_access,ensure_can_administer.
Dependencies
Before adding a gem ask: can vanilla Rails do this? Is 50-150 lines in-repo simpler than a dependency? Commonly skipped: Devise, Pundit, ViewComponent, RSpec, FactoryBot, Redis (Solid Queue/Cache/Cable use the DB), service objects, form objects, decorators, GraphQL, SPA frameworks, Tailwind.
Review Priorities
- Correctness and data safety.
- Multi-tenant/security boundaries.
- Maintainability and readability.
- Performance hot spots.
- Style and polish.
Always Flag
- Unscoped record lookups in tenant-aware flows (
Comment.find(params[:id])). - New dependencies without strong justification.
- In-memory filtering/sorting that belongs in SQL (and
.map(&:name)where.pluck(:name)works). - Service objects replacing straightforward model methods.
- Non-RESTful custom actions when resource modeling is clearer.
- Boolean state columns where a record would capture who/when.
- Pages with forms using HTTP caching (
fresh_when/etag) — stale CSRF tokens cause 422s. - String status checks (
status == "x") when predicate-style APIs are available (StringInquirer / string enums). validates :x, uniqueness: truewithout a backing unique index.- Helpers depending on implicit instance variables instead of explicit arguments.
- Unescaped interpolation into
html_safestrings — escape first:"<b>#{h(input)}</b>".html_safe. - Metaprogramming for 2-3 cases — just write the methods.
- Private-only concerns — inline them.
Review Output
- Start with highest-severity findings.
- For each finding: issue, impact, concrete fix with file:line references.
- Be direct and practical; "This is over-engineered" is a complete sentence.
- End with either
Ship itor a short prioritized fix list.
How to use rails-best-practices-core on Cursor
AI-first code editor with Composer
Prerequisites
Before installing skills in Cursor, ensure your development environment meets these requirements:
- ›Cursor installed and configured on your development machine
- ›Node.js version 16.0+ with npm package manager (verify with
node --version) - ›Active project directory or workspace where you want to add rails-best-practices-core
Execute installation command
Execute the skills CLI command in your project's root directory to begin installation:
The skills CLI fetches rails-best-practices-core from GitHub repository marckohlbrugge/37signals-skills and configures it for Cursor.
Select Cursor when prompted
The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:
Verify installation
Confirm successful installation by checking the skill directory location:
Reload or restart Cursor to activate rails-best-practices-core. Access the skill through slash commands (e.g., /rails-best-practices-core) or your agent's skill management interface.
Security & Verification Notice
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.
List & Monetize Your Skill
Submit your Claude Code skill and start earning
Use Cases▌
Task Automation & Efficiency
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Knowledge Enhancement
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Quality Improvement
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Implementation Guide▌
Prerequisites
- ›Claude Desktop or compatible AI client with skill support
- ›Clear understanding of task or problem to solve
- ›Willingness to iterate and refine outputs
Time Estimate
15-45 minutes depending on use case complexity
Installation Steps
- 1.Install skill using provided installation command
- 2.Test with simple use case relevant to your work
- 3.Evaluate output quality and relevance
- 4.Iterate on prompts to improve results
- 5.Integrate into regular workflow if valuable
Common Pitfalls
- ⚠Expecting perfect results without iteration
- ⚠Not providing enough context in prompts
- ⚠Using skill for tasks outside its intended scope
- ⚠Accepting outputs without review and validation
Best Practices▌
✓ Do
- +Start with clear, specific prompts
- +Provide relevant context and constraints
- +Review and refine all outputs before using
- +Iterate to improve output quality
- +Document successful prompt patterns
✗ Don't
- −Don't use without understanding skill limitations
- −Don't skip validation of outputs
- −Don't share sensitive information in prompts
- −Don't expect skill to replace human judgment
💡 Pro Tips
- ★Be specific about desired format and style
- ★Ask for multiple options to choose from
- ★Request explanations to understand reasoning
- ★Combine AI efficiency with human expertise
When to Use This▌
✓ Use When
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid When
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
Learning Path▌
- 1Familiarize yourself with skill capabilities and limitations
- 2Start with low-risk, non-critical tasks
- 3Progress to more complex and valuable use cases
- 4Build expertise through regular use and experimentation
Discussion
Product Hunt–style comments (not star reviews)- No comments yet — start the thread.
Ratings
4.8★★★★★70 reviews- ★★★★★Harper Liu· Dec 28, 2024
rails-best-practices-core reduced setup friction for our internal harness; good balance of opinion and flexibility.
- ★★★★★Nia Tandon· Dec 28, 2024
rails-best-practices-core has been reliable in day-to-day use. Documentation quality is above average for community skills.
- ★★★★★Ira Srinivasan· Dec 24, 2024
Registry listing for rails-best-practices-core matched our evaluation — installs cleanly and behaves as described in the markdown.
- ★★★★★Pratham Ware· Dec 20, 2024
Solid pick for teams standardizing on skills: rails-best-practices-core is focused, and the summary matches what you get after install.
- ★★★★★Ira Anderson· Dec 20, 2024
Useful defaults in rails-best-practices-core — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
- ★★★★★Chen Choi· Dec 12, 2024
Solid pick for teams standardizing on skills: rails-best-practices-core is focused, and the summary matches what you get after install.
- ★★★★★Amina Malhotra· Dec 8, 2024
I recommend rails-best-practices-core for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
- ★★★★★Isabella Anderson· Dec 4, 2024
We added rails-best-practices-core from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
- ★★★★★Amina White· Nov 27, 2024
Keeps context tight: rails-best-practices-core is the kind of skill you can hand to a new teammate without a long onboarding doc.
- ★★★★★Isabella Gonzalez· Nov 23, 2024
rails-best-practices-core reduced setup friction for our internal harness; good balance of opinion and flexibility.
showing 1-10 of 70