Test the compatibility range instead of asserting it

[VSN2015]

CI ran exactly one combination — the newest of everything — while the gemspec advertised activesupport >= 5.0, < 9. Testing the range found two real problems.

Finding 1: no contract can be declared on activesupport 5.0 or 5.1

The registry is class_attribute :permittable_contracts, default: [], and class_attribute's default: arrived in Rails 5.2. On 5.0/5.1 it's silently ignored, so the attribute is nil:

lib/permittable.rb:659:in `permit_params': undefined method `+' for nil:NilClass (NoMethodError)
      self.permittable_contracts = permittable_contracts + [rule]

Nobody reported it because nobody could have — Rails 5 doesn't run on Ruby 3.2, which is this gem's own floor. The advertised range was simply wrong.

Finding 2: require "permittable" raised on activesupport ≤ 7.0.8.4

NameError: uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger
  activesupport-6.1.7.10/lib/active_support/logger_thread_safe_level.rb:16

concurrent-ruby 1.3.5 stopped requiring logger for those versions, and this gem's first line is require "active_support". Fixed with one stdlib require "logger" ahead of it, so the gem loads whatever the host's own boot order happens to be. spec/spec_helper.rb needs the same, since it requires activerecord first.

The floor is now >= 6.1

That's the oldest line the full suite is actually run against. 5.2 and 6.0 do load and validate (verified), but they predate Ruby 3.x support — and claiming an untested version is exactly the habit this PR breaks. The gemspec now says why, in a comment, so nobody has to rediscover it.

The matrix

One pinned gemfile per activesupport line under gemfiles/ — plain BUNDLE_GEMFILE, no new dev dependency — crossed with the supported Rubies as an explicit include list rather than a cross product, so it doubles as the answer to "which combinations are supported?":

	Ruby 3.2	Ruby 3.3	Ruby 3.4
newest (root Gemfile)	✅	✅	✅
activesupport 6.1	✅
activesupport 7.0	✅
activesupport 7.1	✅	✅
activesupport 7.2	✅		✅
activesupport 8.0	✅		✅
activesupport 8.1			✅

Variant lockfiles stay uncommitted on purpose: each run resolves the newest patch of its line, so a regression in a supported version fails CI instead of being frozen out by a stale lock.

Verified locally on Ruby 3.2 — 199 examples, 0 failures on every one of 6.1, 7.0, 7.1, 7.2, 8.0, 8.1 and the root Gemfile.

A job that proves the gem's central claim

"activesupport is the only runtime dependency" is the gemspec's main promise, and the spec suite cannot test it — it bundles actionpack and activerecord to exercise the integration and schema-drift paths.

The new runtime-deps job installs the built gem with nothing but its declared dependencies, asserts actionpack/activerecord/rails are genuinely absent, and then exercises every controller-free surface:

declared runtime dependencies
  ok   activesupport is the only one
environment
  ok   action_controller is genuinely absent
  ...
standalone contracts
  ok   casts, defaults, normalizes and finalizes
  ok   nested plain hashes convert without the Rails core extensions
  ok   reports violations as data, with qualified paths
  ok   a missing root carries 400 semantics
the concern on a plain params duck
  ok   validates without before_action, rescue_from, logger or render
  ok   unknown: :error works with no logger to warn through
  ok   sensitive: registers for redaction with no Railtie to install the filter
  ok   monitor mode passes raw params through with no logger
  ok   instrumentation fires through activesupport alone
exporters
  ok   JSON Schema exports from the frozen rule
  ok   OpenAPI assembles a document without Rails routes
generator
  ok   drafts a contract from a scanned permit call, with no model to read

PASS — activesupport is enough.

Every respond_to? / defined? guard in the gem is a promise. A missing one now fails CI instead of a user's boot. The nested-plain-hash check is the 0.5.1 regression, permanently pinned outside Rails.

Verification

• 199 examples, 0 failures on all six activesupport lines plus the root Gemfile (Ruby 3.2, local)
• runtime_deps_smoke.rb passes against the built gem in an isolated GEM_HOME
• RuboCop clean, 33 files
• Ruby 3.3 / 3.4 rows are covered by CI on this PR — I only have 3.2 locally

[VSN2015]

Review of PR #14: Excellent compatibility matrix expansion. Explicitly testing the ActiveSupport matrix across real Ruby versions and testing with minimal runtime dependencies validates the gem's core claims.

[VSN2015]

Crucial fix: explicitly requiring logger ahead of active_support prevents NameError on ActiveSupport <= 7.0.8.4 under concurrent-ruby >= 1.3.5.

[VSN2015]

Accurate adjustment of the runtime dependency floor to >= 6.1. Given class_attribute ..., default: requirements and Ruby 3.x compatibility, this reflects the true supported range.

[VSN2015]

Very nice smoke test. Validating runtime_dependencies programmatically against the installed gem guarantees no transitive or dev gems leak into runtime requirements.