hecks 0.2.0 → 0.3.0

data/lib/hecks/ports/access_control.rb

@@ -0,0 +1,62 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # WHO CAN SIGN IN, AND WHAT ROLE DO THEY HOLD — the domain-specific
+    # half of sign-in `Ports::Authentication` deliberately stays out of
+    # (see that port's own header: it only ever talks to the external
+    # provider, never this registry's own data). Resolved the same way
+    # every other port here resolves its adapter: one adapter
+    # registry-wide answers this, since an app has no reason to want a
+    # different "who's allowed in" source per aggregate.
+    #
+    # Every domain shapes this differently — who its own "a person who
+    # can sign in" aggregate is, what admits them, what grants them
+    # access — so this port is pure delegation, same as every sibling
+    # port. The one piece of this that IS generic (a live Governance
+    # grant should win over whatever an aggregate's own role field
+    # says) lives on `Ports::Authorization#live_role_for` instead —
+    # a domain's adapter here calls that directly, rather than this
+    # port re-deriving Governance-query logic another port already owns.
+    module AccessControl
+      NAME = "access_control"
+
+      module_function
+
+      def session_for_identity(registry, identity_id:)
+        adapter(registry).session_for_identity(registry, identity_id: identity_id)
+      end
+
+      def provision(registry, email:, issuer:, subject:)
+        adapter(registry).provision(registry, email: email, issuer: issuer, subject: subject)
+      end
+
+      def available_roles(registry)
+        adapter(registry).available_roles(registry)
+      end
+
+      def grant(registry, email:, role:)
+        adapter(registry).grant(registry, email: email, role: role)
+      end
+
+      def all_people(registry)
+        adapter(registry).all_people(registry)
+      end
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can answer who's allowed in"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/agent/answers.rb

@@ -0,0 +1,104 @@
+module Hecks
+  module Ports
+    module Agent
+      # WHERE A RAW HASH BECOMES A STRUCT — the one place, so every
+      # adapter (the real `claude_code` one, and any scripted double
+      # standing in for it in a spec) is held to the identical shape.
+      # An adapter's whole job ends at "here is what came back, already
+      # JSON"; whether that hash is USABLE is decided once, here, not
+      # re-decided per adapter.
+      #
+      # Every failure raises `ValidationError` — never lets a bare
+      # `NoMethodError` on nil, or a `KeyError`, reach a caller looking
+      # for an agent-shaped failure. `bin/interview` catches exactly one
+      # class for "the model answered badly," not a grab-bag of Ruby's
+      # own.
+      module Answers
+        VERB_PATTERN = /\A[A-Za-z]+::[A-Za-z]+\.[A-Za-z]+\z/
+
+        module_function
+
+        def questions(raw)
+          rows(raw, "questions").map { |row| Question.new(text: text!(row, "text"), because: text!(row, "because")) }
+        end
+
+        def proposals(raw)
+          rows(raw, "proposals").map do |row|
+            Proposal.new(verb: verb!(row), rationale: text!(row, "rationale"), arguments: arguments!(row))
+          end
+        end
+
+        def findings(raw)
+          rows(raw, "findings").map do |row|
+            Finding.new(kind: kind!(row), severity: severity!(row), subject: text!(row, "subject"),
+                        message: text!(row, "message"))
+          end
+        end
+
+        def suggestions(raw)
+          rows(raw, "names").map do |row|
+            Suggestion.new(name: text!(row, "name"), because: text!(row, "because"),
+                           rejected: Array(row["rejected"]).map(&:to_s))
+          end
+        end
+
+        # ── shared checks, each named for what it refuses ───────────────
+
+        def rows(raw, key)
+          raise ValidationError, "expected a Hash back, got #{raw.class}: #{raw.inspect}" unless raw.is_a?(Hash)
+
+          value = raw[key]
+          return value if value.is_a?(Array)
+
+          raise ValidationError, "no #{key.inspect} array in the answer: #{raw.inspect}"
+        end
+
+        def text!(row, key)
+          value = row[key]
+          return value.to_s if value && !value.to_s.strip.empty?
+
+          raise ValidationError, "#{key.inspect} missing or blank in #{row.inspect}"
+        end
+
+        # A VERB THE LANGUAGE COULD NOT EVEN PARSE IS AN ADAPTER FAULT,
+        # refused right here — the same `not_fully_qualified` shape the
+        # language's own grammar already refuses by, reused rather than
+        # reinvented. A verb naming a real category that turns out to
+        # describe the wrong fact is NOT this port's business: that one
+        # dispatches, and `Interview::Session#offer` is what says no.
+        def verb!(row)
+          verb = row["verb"].to_s
+          return verb if VERB_PATTERN.match?(verb)
+
+          raise ValidationError, "#{verb.inspect} is not a fully-qualified verb (Chapter::Aggregate.Command)"
+        end
+
+        def kind!(row)
+          kind = row["kind"].to_s.to_sym
+          return kind if CRITIQUE_KINDS.include?(kind)
+
+          raise ValidationError, "#{kind.inspect} is not a critique kind this port knows (#{CRITIQUE_KINDS.join(', ')})"
+        end
+
+        def severity!(row)
+          severity = row["severity"].to_s.to_sym
+          return severity if SEVERITIES.include?(severity)
+
+          raise ValidationError, "#{severity.inspect} is not a severity this port knows (#{SEVERITIES.join(', ')})"
+        end
+
+        # ROWS SHAPED EXACTLY AS `Interview::Proposal::Argument` — a
+        # reference's `field` is legitimately blank (a reference IS an
+        # id), so only `name` is required here.
+        def arguments!(row)
+          Array(row["arguments"]).map do |argument|
+            name = argument["name"].to_s
+            raise ValidationError, "argument row has no name: #{argument.inspect}" if name.empty?
+
+            { name: name, field: argument["field"].to_s, value: argument["value"].to_s }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/agent.port

@@ -0,0 +1,4 @@
+Hecks.port "agent" do
+  verb   "asked_by"
+  signal :reply
+end

data/lib/hecks/ports/agent.rb

@@ -0,0 +1,167 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # THE INTERVIEWER — whatever asks the next good question, reads a
+    # sentence back into proposed declarations, judges a model on taste
+    # rather than structure, or suggests a name. Resolved the singleton
+    # way every other port here is (`Ports::IdentityGeneration`'s own
+    # zero/one/many — one interviewer per process, never per-aggregate),
+    # because a second adapter answering this port is exactly as
+    # unchoosable as a second one minting identities.
+    #
+    # BUILT LAST, ON PURPOSE, AND STILL OPTIONAL. `.claude/skills/
+    # interview/SKILL.md` conducts a whole session with NONE of this —
+    # Claude Code reads `bin/interview state` itself, asks the human
+    # directly with real conversation context, and calls `bin/interview
+    # ask`/`propose`/`accept` itself. This port exists for what that
+    # cannot reach: a HEADLESS run (`bin/interview suggest`, no model in
+    # the room otherwise), a batch `critique` over an already-written
+    # chapter, and — the actual point of building it at all — a
+    # SCRIPTED double (`spec/fixtures/scripted_agent.rb`) that makes the
+    # whole loop testable with no real model involved.
+    #
+    # WHAT THIS PORT IS NOT. It does not judge whether a declaration is
+    # WELL-FORMED — that is the meta-domain's own job, answered by a real
+    # dispatch refusing or not (`Interview::Session#offer`). This port
+    # only ever produces SHAPE: a question, a proposed declaration, a
+    # judgement about taste, a name. A proposal naming a category the
+    # language does not declare is an ADAPTER fault, refused HERE, in
+    # `Answers`; a proposal naming a real category but describing the
+    # wrong domain fact is dispatched anyway, so the LANGUAGE gets to say
+    # why. That line is the whole design.
+    #
+    # PARSING BELONGS TO THIS FILE, NOT THE ADAPTER. An adapter answers
+    # with a plain, already-JSON-shaped Hash (a real model's parsed
+    # reply, or a spec double's own hand-built one) — never a Struct —
+    # so every adapter is validated identically here rather than trusting
+    # each one to refuse the same way. Two adapters that parsed
+    # differently would mean the SAME malformed answer passing through
+    # one and refusing through the other.
+    module Agent
+      NAME = "agent"
+
+      # The answer came back and could not be used — no JSON in it, a
+      # category the language does not declare, a severity outside the
+      # two that exist. A foreign failure (JSON::ParserError, a missing
+      # key) wrapped into something this port owns, the same shape
+      # `Ports::Authentication::ValidationError` already is, so no
+      # caller ever rescues a raw parser error leaking out of an
+      # adapter.
+      ValidationError = Class.new(StandardError)
+
+      # Nothing answered at all — the binary is missing, the subprocess
+      # died, the call timed out. Separate from ValidationError on
+      # purpose: unavailable means retry or fall back to asking the
+      # human directly; malformed means the PROMPT is wrong, not the
+      # transport, and retrying identically will not fix it.
+      Unavailable = Class.new(StandardError)
+
+      # ── what the four operations hand back ──────────────────────────
+      #
+      # Structs, not hashes, for the reason `Bluebook::ModelCheck::Finding`
+      # already is one: a `keyword_init` Struct raises on a key nobody
+      # declared, which turns "the model invented a field" into a
+      # failure at the boundary rather than a nil three calls in.
+
+      # ONE QUESTION. `because` is the reasoning quoted back so a human
+      # can see it, not decoration — the same "show your work" the
+      # language's own refusal messages already practice.
+      Question = Struct.new(:text, :because, keyword_init: true)
+
+      # ONE PROPOSED DECLARATION, already shaped as
+      # `Interview::Proposal`'s own `Argument` rows — `{name:, field:,
+      # value:}`, the exact triple `bin/interview propose --arg
+      # name:field:value` already takes and `Interview::Lowering`
+      # already knows how to lower. Nothing here decides HOW to address
+      # a record or whether a value is bare or wrapped — that was
+      # already the proposal-writer's job in `interview.bluebook`'s own
+      # design (see `Argument`'s own comment there); this only adds the
+      # PROSE reasoning a human typed does not carry on its own.
+      Proposal = Struct.new(:verb, :arguments, :rationale, keyword_init: true)
+
+      # CRITIQUE REUSES `Bluebook::ModelCheck::Finding`'S OWN SHAPE —
+      # same fields, same severities, so a mechanical finding
+      # (`Session#gaps`) and a judgement (this) print in one list and
+      # sort together. The KIND vocabulary is NOT shared — ModelCheck's
+      # eleven kinds are structural facts about a graph; these are
+      # opinions about a model, closed here on purpose (an open kind
+      # field is an open prompt, and an open prompt drifts).
+      CRITIQUE_KINDS = %i[
+        anemic_aggregate wrong_boundary crud_verb leaky_value_object
+        missing_lifecycle missing_invariant ubiquitous_language
+        overreaching_identity untold_rule
+      ].freeze
+      SEVERITIES = %i[error warning].freeze
+
+      Finding = Struct.new(:kind, :severity, :subject, :message, keyword_init: true) do
+        def to_s = "#{severity.to_s.upcase.ljust(7)} #{kind.to_s.ljust(20)} #{subject}  —  #{message}"
+      end
+
+      # ONE SUGGESTED NAME. `rejected` carries the near-misses and why
+      # they were passed over — free at the point the model is choosing
+      # anyway, and the part a human actually learns from.
+      Suggestion = Struct.new(:name, :because, :rejected, keyword_init: true)
+
+      module_function
+
+      # THE NEXT BEST QUESTION. `state` is the whole picture — normally
+      # `Interview::Session#declaration` plus `#gaps`, so an adapter
+      # needs no memory of its own between calls; that is what lets a
+      # headless run be a series of one-shot processes, same as
+      # `bin/interview` itself already is.
+      def ask(registry, state:, asked: [])
+        Answers.questions(adapter(registry).ask(state: state, asked: asked))
+      end
+
+      # PROSE -> PROPOSED DECLARATIONS. Returns `[]` when the sentence
+      # carried no declaration at all (a clarifying question back from
+      # the human, say) — a legitimate answer, not a failure.
+      def interpret(registry, prose:, state:)
+        Answers.proposals(adapter(registry).interpret(prose: prose, state: state))
+      end
+
+      # WHAT IS WRONG WITH THIS AS A MODEL — handed everything already
+      # known (the language's own refusals, `Session#gaps`'s mechanical
+      # findings) so it spends its judgement on what neither of those
+      # can see, rather than restating them.
+      def critique(registry, declared:, refusals: [], findings: [])
+        Answers.findings(adapter(registry).critique(declared: declared, refusals: refusals, findings: findings))
+      end
+
+      # VOCABULARY HELP. `near` is what the chapter already calls
+      # things, so a suggestion cannot collide with a name in use.
+      #
+      # NAMED `suggest_name`, NOT `name` — the plan's own word for this
+      # operation, but `Module#name` already exists and is load-bearing
+      # everywhere (backtraces, RSpec's own description building,
+      # `inspect`): a module-function called `name` SHADOWS it the
+      # instant it's defined, and `SomeModule.name` (no args) then
+      # raises `ArgumentError: missing keywords` the next time anything
+      # — not this file, something else entirely — asks the module its
+      # own name. Measured, not theoretical: this exact collision broke
+      # RSpec's own failure-message formatting the first time it was
+      # named `name` here.
+      def suggest_name(registry, meaning:, kind:, near: [])
+        Answers.suggestions(adapter(registry).suggest_name(meaning: meaning, kind: kind, near: near))
+      end
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can conduct an interview"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end
+
+require_relative "agent/answers"

data/lib/hecks/ports/authentication.port

@@ -0,0 +1,4 @@
+Hecks.port "authentication" do
+  verb   "authenticated_by"
+  signal :reply
+end

data/lib/hecks/ports/authentication.rb

@@ -0,0 +1,50 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # THE OIDC HANDSHAKE ITSELF — building the URL a browser goes to,
+    # and turning the code a provider sends back into a verified
+    # (issuer, subject, email) triple. Resolved the same way every
+    # other port here resolves its adapter: one adapter registry-wide
+    # answers this, not a per-aggregate binding, since a domain has no
+    # reason to want a different sign-in provider per aggregate.
+    #
+    # THE OTHER HALF of "who is this" — what a verified pair MEANS to
+    # this app, whether it resolves to an existing Identity — is
+    # `Ports::IdentityResolution`'s job, not this one's. This port only
+    # ever talks to the external provider; it never touches the
+    # registry's own Identity/Governance data (it takes `registry`
+    # purely to resolve which adapter answers it, same as every port
+    # here already does).
+    module Authentication
+      NAME = "authentication"
+
+      ValidationError = Class.new(StandardError)
+
+      module_function
+
+      def authorization_url(registry)
+        adapter(registry).authorization_url
+      end
+
+      def verify(registry, code:, state:, expected_state:)
+        adapter(registry).verify(code: code, state: state, expected_state: expected_state)
+      end
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can authenticate a sign-in"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/authorization.port

@@ -0,0 +1,4 @@
+Hecks.port "authorization" do
+  verb   "authorized_by"
+  signal :reply
+end

data/lib/hecks/ports/authorization.rb

@@ -0,0 +1,59 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # TWO YES/NO QUESTIONS AND ONE VALUE an application asks BEFORE
+    # binding a caller — resolved the same way `Ports::IdentityGeneration`
+    # resolves its own adapter: one adapter registry-wide answers this
+    # port, not a per-aggregate binding, since a domain has no reason to
+    # want a different authorization source per aggregate. What answers
+    # it is deliberately not named here — the governance-backed adapter
+    # is one implementation, not the only possible one, the same way
+    # `SequentialIdentity` and `SecureRandomIdentity` are two
+    # implementations of `identity_generation`.
+    #
+    # A caller decides what to DO with the answer — dispatch under that
+    # role, refuse, log, prefer it over some other fallback value — this
+    # only answers the question asked. Nothing here binds a
+    # `Runtime::Caller`, and nothing here is consulted by
+    # `CommandRules::Authorization`: that rule still only compares an
+    # ALREADY-BOUND caller's role against a command's, the same as it
+    # always has. `spec/act_as_spec.rb` remains the precedent for the
+    # OTHER shape — two separate registries, queried directly by name —
+    # for whenever Governance is not in the same boot as the caller;
+    # this port is the same two questions asked through one adapter
+    # when it is.
+    module Authorization
+      NAME = "authorization"
+
+      module_function
+
+      def holds_role?(registry, actor_id:, role:)
+        adapter(registry).holds_role?(registry, actor_id: actor_id, role: role)
+      end
+
+      def authorized_as?(registry, from_role:, to_role:)
+        adapter(registry).authorized_as?(registry, from_role: from_role, to_role: to_role)
+      end
+
+      def live_role_for(registry, actor_id:)
+        adapter(registry).live_role_for(registry, actor_id: actor_id)
+      end
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can answer a role check"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/clock.port

@@ -0,0 +1,4 @@
+Hecks.port "clock" do
+  verb   "timed_by"
+  signal :reply
+end

data/lib/hecks/ports/clock.rb

@@ -0,0 +1,62 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # WHAT TIME IT IS — the one fact a domain cannot derive and must not invent.
+    #
+    # Resolved exactly the way `Ports::IdentityGeneration` resolves its own
+    # adapter: one adapter registry-wide implements this, not a per-aggregate
+    # binding, because two aggregates in one running app have no real reason to
+    # disagree about the time.
+    #
+    # WHY A PORT AND NOT `Time.now`. A staleness rule — "another agent may take
+    # this claim after fifteen minutes" — is untestable against the real clock:
+    # a spec for it would either sleep for fifteen minutes or never run at all.
+    # Bound to a fixed adapter, the same rule is three lines. That is the whole
+    # argument, and it is the same one `SequentialIdentity` makes next door.
+    #
+    # A PREDICATE STILL CANNOT ASK THE TIME, and this does not change that. The
+    # expression sublanguage has no clock and should not: a `given` that read
+    # the time would evaluate differently on two runs over the same record, and
+    # every replay, audit and fuzz oracle in this repository assumes it does
+    # not. So `now` remains an ARGUMENT the predicate merely reads, and this
+    # port is what lets a caller stop typing it — the door fills it in, the
+    # value is baked into the dispatch, and the recorded step carries the
+    # concrete number forever after.
+    #
+    # WHICH IS WHY THE RUNTIME DOES NOT CALL THIS. `IdentityGeneration`'s own
+    # note works through the replay question for a minted uuid and lands on
+    # "the value gets baked into the caller's args at the first live dispatch".
+    # A clock consulted INSIDE the interpreter would not have that property: a
+    # recorded corpus step replayed tomorrow would silently get tomorrow's
+    # time, and the fuzzer's oracle and the adapter-agreement gate both compare
+    # runs of exactly that shape. So the filling happens at the door, where a
+    # human or an agent is typing, and never on the dispatch path a replay uses.
+    module Clock
+      NAME = "clock"
+
+      module_function
+
+      # SECONDS, AS AN INTEGER, because that is what the sublanguage can do
+      # arithmetic on. `claimed_at.value + window.value <= now.value` is
+      # addition and comparison — the only two things it has — and a Time
+      # object supports neither.
+      def now(registry) = adapter(registry).now
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can say what time it is"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/extraction.port

@@ -0,0 +1,4 @@
+Hecks.port "extraction" do
+  verb   "extracted_by"   
+  signal :reply           
+end

data/lib/hecks/ports/extraction.rb

@@ -0,0 +1,37 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    module Extraction
+      NAME = "extraction"
+
+      module_function
+
+      def canonical(block) = adapter.canonical(block)
+
+      def adapter
+        registry = Hecks.current_registry
+        unless registry
+          raise Runtime::WiringError,
+                "extraction resolved outside a boot — a predicate can only be " \
+                "read while a bluebook is loading"
+        end
+
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can recover a " \
+                "predicate's source"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime " \
+                "will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/identity_assignment.port

@@ -0,0 +1,4 @@
+Hecks.port "identity_assignment" do
+  verb   "assigned_by"
+  signal :reply
+end

data/lib/hecks/ports/identity_assignment.rb

@@ -0,0 +1,45 @@
+require_relative "../runtime/registry"
+
+module Hecks
+  module Ports
+    # WHICH VALUE A CREATING COMMAND'S OWN IDENTITY FIELD GETS, when
+    # neither a slug-from-another-field nor a sequence-with-prefix
+    # mechanically answers it — a driving app's own console, say,
+    # falls back to this when a collection's identity strategy names
+    # "port" rather than "slug"/"sequence" (both of those stay pure
+    # config-driven mechanics, computed by whoever is dispatching,
+    # never by this port).
+    #
+    # Pure delegation, same as every sibling port (AccessControl,
+    # IdentityGeneration): an app's own domain declares what "port"
+    # actually MEANS for it — mint a real UUID via
+    # Ports::IdentityGeneration, derive something else entirely — this
+    # port just resolves the one adapter that domain wired and calls
+    # it, the same "one adapter registry-wide, refuse if zero or many"
+    # resolution every other port here already uses.
+    module IdentityAssignment
+      NAME = "identity_assignment"
+
+      module_function
+
+      def assign(registry, agg_name:, field_name:, args:)
+        adapter(registry).assign(registry, agg_name: agg_name, field_name: field_name, args: args)
+      end
+
+      def adapter(registry)
+        implementations = registry.adapters.values.select { |a| a.port == NAME }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0
+          raise Runtime::WiringError,
+                "no adapter implements the #{NAME} port — nothing can assign an identity"
+        else
+          raise Runtime::WiringError,
+                "#{implementations.size} adapters implement the #{NAME} port " \
+                "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/identity_generation.port

@@ -0,0 +1,4 @@
+Hecks.port "identity_generation" do
+  verb   "generated_by"
+  signal :reply
+end