hecks 1.4.0 → 1.5.0

data/lib/hecks/tenancy/bluebook/tenancy.bluebook

@@ -0,0 +1,130 @@
+# ITS OWN BOUNDED CONTEXT, booted centrally like `Deploy` — never
+# attached via `uses_framework` (a framework member's aggregate folds
+# into the ATTACHING domain's own per-boot registry, framework.rb:43-66
+# — since hecks gives each tenant its own separate `Runtime.boot`, a
+# framework-attached Tenant would exist as a single-row copy inside
+# EVERY tenant's own boot, never as one cross-tenant list, defeating
+# this domain's whole point). `Deploy::Tenant` (deploy.bluebook) stays
+# a SEPARATE, validation-only aggregate — a shape check before
+# provisioning; this is the durable, reactable runtime fact that
+# aggregate's own comment named and deliberately deferred. Two
+# different meanings of "Tenant," on purpose, translated at the one
+# explicit seam `tenancy.hecksagon`'s own `translates` line names.
+Hecks.bluebook "Tenancy" do
+  vision "Which tenants exist, which realm and storage each one owns, and whether each is currently allowed to run, is one queryable, historical fact — not scattered across a world-file overlay and a validation-only command."
+
+  supporting
+
+  aggregate "Tenant" do
+    description "One tenant's durable identity and lifecycle — registered, then active or suspended, until retired."
+
+    identified_by :slug
+
+    attribute :slug,   Slug
+    attribute :domain, DomainName
+    attribute :realm,  Realm
+    attribute :schema, Schema
+    attribute :status, Status, default: { value: "Active" }
+
+    value_object "Slug" do
+      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      invariant("a tenant slug is named") { !value.to_s.empty? }
+    end
+
+    value_object "DomainName" do
+      attribute :value, String
+      invariant("a tenant names the domain it is for") { !value.to_s.empty? }
+    end
+
+    value_object "Realm" do
+      attribute :value, String
+      invariant("a tenant realm is named") { !value.to_s.empty? }
+    end
+
+    value_object "Schema" do
+      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      invariant("a schema is named") { !value.to_s.empty? }
+    end
+
+    value_object "Status" do
+      attribute :value, String, one_of: ["Active", "Suspended", "Retired"]
+    end
+
+    # FIRES AFTER PROVISIONING, NEVER BEFORE — a pure record with no
+    # side effects, dispatched by `tenancy.hecksagon`'s own `translates`
+    # reaction once `Deploy::Tenant.Provision`'s adapter has already
+    # written the world overlay and proven the domain boots. Driving
+    # provisioning FROM this command's own emission would need a
+    # process manager reacting to it — the exact durable-saga cost
+    # `deploy.bluebook`'s own `Tenant` aggregate comment already argued
+    # three local, idempotent, single-process steps don't need.
+    command "Register" do
+      goal "Record that a tenant now exists, after its shape has been validated and its schema provisioned"
+
+      attribute :slug,   Slug
+      attribute :domain, DomainName
+      attribute :realm,  Realm
+      attribute :schema, Schema
+
+      sets :slug
+      sets :domain
+      sets :realm
+      sets :schema
+
+      emits "TenantRegistered"
+    end
+
+    # RECORD-ONLY — nothing today reads `status` before dispatch or
+    # boot, so suspending a tenant here does not yet stop anything from
+    # running. Spelled out in this command's own `goal`, not just a
+    # comment, so it survives into generated docs/corpus rather than
+    # quietly reading as enforced when it isn't — the exact "a dial
+    # says a check runs when nothing runs it" defect class this
+    # project has already been burned by once.
+    command "Suspend" do
+      goal "Record that a tenant should no longer be treated as active — nothing yet enforces this at dispatch or boot time"
+
+      reference_to Tenant
+
+      sets :status, to: "Suspended"
+
+      emits "TenantSuspended"
+    end
+
+    command "Reactivate" do
+      goal "Restore a suspended tenant to active"
+
+      reference_to Tenant
+
+      sets :status, to: "Active"
+
+      emits "TenantReactivated"
+    end
+
+    # RECORD-ONLY, DELIBERATELY — dropping a live Postgres schema as an
+    # automatic side effect of a command handler would break the pure,
+    # no-adapter-calls-from-a-handler shape every other command in this
+    # corpus holds to. Real teardown, if ever built, is its own
+    # separate, deliberately reviewed tool — never implicit here.
+    command "Retire" do
+      goal "Record that a tenant is permanently done — real schema teardown is a deliberately separate, manually-run tool, never automatic here"
+
+      reference_to Tenant
+
+      sets :status, to: "Retired"
+
+      emits "TenantRetired"
+    end
+
+    query "Active" do
+      description "Every tenant currently allowed to run."
+      where(status: "Active")
+    end
+
+    query "BySlug" do
+      description "One tenant's current record, by its slug."
+      attribute :slug, Slug
+      where(slug: :slug)
+    end
+  end
+end

data/lib/hecks/tenancy/bluebook/tenancy.hecksagon

@@ -0,0 +1,32 @@
+Hecks.hecksagon "Tenancy" do
+  Tenancy::Tenant.persisted_by("LocalStorage")
+
+  # THE TRANSLATION SEAM — the one explicit place Deploy's "Tenant"
+  # (a validated request) becomes Tenancy's "Tenant" (a durable fact).
+  # `on` deliberately omits the "Deploy::" prefix: PolicyInterpreter
+  # matches by event name plus the emitting aggregate's own demodulised
+  # name only, never the domain (confirmed live — a domain-qualified
+  # `on` silently never matches).
+  #
+  # `with:` IS REQUIRED, confirmed live — `TenantProvisioned`'s own
+  # payload is the ANSWER (slug/domain/realm/schema) merged with the
+  # port operation's OWN dispatch-time args (database/adapter,
+  # PortOperationInterpreter#ask's `ctx.args.merge(spread(answer))`),
+  # so the whole payload forwarded verbatim carries two fields
+  # `Register` never declares and gets refused outright.
+  # CHECKED TOGETHER, NOT IN ISOLATION — `bin/model_check`'s own
+  # `deaf_policy` check only sees ONE domain's own emitted events by
+  # default, which would flag this reaction as deaf (it reacts to a
+  # FOREIGN event, not one Tenancy itself emits). Fixed by
+  # `global_emitted_events:`, a cross-domain set `bin/model_check`
+  # builds across every target it boots in one run — run `bin/model_check
+  # lib/hecks/deploy lib/hecks/tenancy` (both targets, one invocation),
+  # not each directory separately, or this reads as a false positive
+  # again. Neither `deploy` nor `tenancy` is in
+  # `Hecks::Corpus::MODEL_CHECK_KINDS`, so the automatic sweep never
+  # reaches this at all, checked or not.
+  translates "RegisterProvisionedTenant" do
+    on Tenant::TenantProvisioned
+    trigger Tenant::Register, with: { slug: :slug, domain: :domain, realm: :realm, schema: :schema }
+  end
+end

data/lib/hecks/version.rb

@@ -12,5 +12,5 @@ module Hecks
   # it there, or even in the consuming Gemfile, never closed the gap,
   # because gemspec evaluation happens before anything Bundler
   # resolves is actually loadable yet.
-  VERSION = "1.4.0".freeze
+  VERSION = "1.5.0".freeze
 end

data/lib/hecks.rb

@@ -1,5 +1,4 @@
 require_relative "hecks/version"
-require_relative "hecks/deprecation"
 # The closed sets the runtime computes with, generated from
 # vocabulary.bluebook. Plain data, required first, because some of
 # them are read while a bluebook is still being parsed.
@@ -67,6 +66,16 @@ module Hecks
     # resolves its own env var name and passes the resulting string
     # straight through, e.g. `Hecks.boot(path, environment:
     # ENV.fetch("MYAPP_ENV", "development"))`.
+    #
+    # @param path [String] path to a domain directory, or a file inside one
+    # @param shared [String, nil] a shared-root override; see `Runtime::Loader.boot`
+    # @param install_facade [Boolean] whether to install the `Widget::Item.Add`-style
+    #   Ruby facade constants for this boot
+    # @param environment [String, nil] the environment name whose
+    #   `environments/<name>.hecksagon`/`.world` overlay, if present, loads after the
+    #   domain's own
+    # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
+    #   to the booted domain
     def boot(path, shared: nil, install_facade: true, environment: nil)
       Runtime.boot(path, shared: shared, install_facade: install_facade, environment: environment)
     end
@@ -75,12 +84,30 @@ module Hecks
     # `.hecksagon`, optionally a `.world`), loaded in place from wherever
     # they actually live — see Runtime::Loader.boot_files's own header for
     # why this exists beside `boot` rather than as a special case of it.
+    #
+    # @param paths [String, Array<String>] one or more file paths within the domain
+    #   to load, instead of the whole directory
+    # @param shared [String, nil] a shared-root override; see `Runtime::Loader.boot_files`
+    # @param install_facade [Boolean] whether to install the `Widget::Item.Add`-style
+    #   Ruby facade constants for this boot
+    # @param environment [String, nil] the environment name passed through to the
+    #   selected-file loader
+    # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
+    #   to the booted domain
     def boot_files(paths, shared: nil, install_facade: true, environment: nil)
       Runtime.boot_files(paths, shared: shared, install_facade: install_facade, environment: environment)
     end
 
+    # Binds the ambient registry for the duration of the block.
+    #
+    # @param registry [Runtime::Registry] the registry to make current for the block
+    # @yield the code that should see `registry` as `current_registry`
+    # @return [Object] the block's result
     def with_registry(registry, &) = Runtime.with_registry(registry, &)
 
+    # Reads the ambient registry a declaration is currently landing in.
+    #
+    # @return [Runtime::Registry, nil] the current registry, or nil outside a boot
     def current_registry = Runtime.current_registry
 
     # Bind who is dispatching for the duration of the block — checked
@@ -97,14 +124,39 @@ module Hecks
     #
     # `as_of` and `scope` are optional too, same shape — see
     # `Runtime.as_caller`'s own header for what each does.
+    #
+    # @param role [String, Symbol] the role to check the caller against
+    # @param actor_id [String, nil] who is calling, checked against a real Governance
+    #   `RoleAssignment` when given; string-equality only against `role` when nil
+    # @param as_of [Integer, nil] Unix epoch seconds to check a matching `RoleAssignment`'s
+    #   own `starts_at` against; unchecked when nil
+    # @param scope [String, nil] the scope to check a matching `RoleAssignment`'s own
+    #   `scope` against; unchecked when nil
+    # @yield the code to run with this caller bound
+    # @return [Object] the block's result
     def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &)
       Runtime.as_caller(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &)
     end
 
+    # Declares a chapter — a `.bluebook` file's top-level word.
+    #
+    # @param name [String] the chapter's declared name
+    # @param version [String, nil] the chapter's pinned version, or nil for unversioned
+    # @yield the chapter's body, evaluated against a `Bluebook::DSL::BluebookBuilder`
+    # @return [Bluebook::Chapter] the built, judged chapter
+    # @raise [LoadOutsideBoot] if called outside `Hecks.boot`/`.boot_files`
+    # @raise [Bluebook::DSL::Malformed] if the chapter fails the language's own judgment
     def bluebook(name, version: nil, &)
       collect(:add_bluebook, Bluebook::DSL::BluebookBuilder.build(name, version: version, &))
     end
 
+    # Declares a hecksagon — a `.hecksagon` file's top-level word, binding a
+    # domain's aggregates to adapters.
+    #
+    # @param name [String, Symbol] the domain's name the hecksagon binds
+    # @yield the hecksagon's body, evaluated against a `Bluebook::DSL::HecksagonBuilder`
+    # @return [Bluebook::Hecksagon] the built hecksagon
+    # @raise [LoadOutsideBoot] if called outside `Hecks.boot`/`.boot_files`
     def hecksagon(name, &) = collect(:add_hecksagon, Bluebook::DSL::HecksagonBuilder.build(name, &))
     # Repointed to DomainPortBuilder — the migration DomainPort's own
     # class comment names as its goal, now landed for the top-level
@@ -127,9 +179,35 @@ module Hecks
     # the literal top-level `.port` file entry point, keeps the older,
     # looser rule (see `DomainPortBuilder#initialize`'s own comment).
     def port(name, &) = collect(:add_port, Bluebook::DSL::DomainPortBuilder.build(name, legacy_bare_port: true, &))
+
+    # Declares an adapter — an `.adapter` file's top-level word.
+    #
+    # @param name [String] the adapter's name
+    # @yield the adapter's body, evaluated against a `Bluebook::DSL::AdapterBuilder`
+    # @return [Bluebook::Adapter] the built, judged adapter
+    # @raise [LoadOutsideBoot] if called outside `Hecks.boot`/`.boot_files`
     def adapter(name, &)   = collect(:add_adapter, Bluebook::DSL::AdapterBuilder.build(name, &))
+
+    # Declares a world — a `.world` file's top-level word, naming a domain's
+    # deployment realm.
+    #
+    # @param name [String, Symbol] the domain's name the world describes
+    # @yield the world's body, evaluated against a `Bluebook::DSL::WorldBuilder`
+    # @return [Bluebook::World] the built, judged world
+    # @raise [LoadOutsideBoot] if called outside `Hecks.boot`/`.boot_files`
     def world(name, &)     = collect(:add_world, Bluebook::DSL::WorldBuilder.build(name, &))
 
+    # Declares a data translation — a `.translation` file's top-level word,
+    # migrating one domain's stored shape from one era to the next.
+    #
+    # @param name [String, Symbol] the domain this translation carries forward
+    # @param from [String, Symbol] the origin era
+    # @param to [String, Symbol] the destination era
+    # @yield the translation's body, evaluated against a
+    #   `Bluebook::DSL::TranslationBuilder`
+    # @return [Bluebook::Translation] the built, judged translation
+    # @raise [LoadOutsideBoot] if called outside `Hecks.boot`/`.boot_files`
+    # @raise [Bluebook::DSL::Malformed] if `name`, `from`, or `to` is empty
     def data_translation(name, from:, to:, &)
       collect(:add_translation, Bluebook::DSL::TranslationBuilder.build(name, from: from, to: to, &))
     end

data/lib/rubocop/cop/hecks/fallback_hash_lookup.rb

@@ -13,6 +13,8 @@ module RuboCop
       # `h[k.to_sym] || h[k]`, reading a value that could arrive keyed
       # either by symbol or by string off the wire).
       #
+      # ## The fix
+      #
       # The fix this codebase already converged on — see
       # `lib/hecks/query_specification/field_path.rb#read`, the shared
       # digger this whole bug class got consolidated behind: check
@@ -28,6 +30,8 @@ module RuboCop
       # mechanically, before it becomes bug #9, rather than found by
       # hand again in a future audit.
       #
+      # ## Scope
+      #
       # Scoped to the `[]`/`[]` shape only, deliberately — a receiver
       # method-call is compared by AST structure (`==`, which ignores
       # source location), so `hash[a] || hash[b]` is flagged whether
@@ -58,6 +62,10 @@ module RuboCop
         # @!method bracket_lookup(node)
         def_node_matcher :bracket_lookup, "(send $_receiver :[] $_key)"
 
+        # Flags an `a[k] || a[k2]` double bracket-lookup on the same receiver.
+        #
+        # @param node [RuboCop::AST::OrNode] the `||` node being visited
+        # @return [void]
         def on_or(node)
           lhs_receiver, lhs_key = bracket_lookup(node.lhs)
           return unless lhs_receiver

data/lib/rubocop/cop/hecks/sequential_hash_rename_in_loop.rb

@@ -6,6 +6,8 @@ module RuboCop
       # in the specific rename/permutation shape this codebase has
       # already lost real data to once.
       #
+      # ## The bug this follows up on
+      #
       # The bug this is the mechanical follow-up to (M27,
       # docs/audits/2026-08-10-main-bug-audit.md,
       # docs/audits/2026-08-11-bug-triage.md; fixed in
@@ -22,7 +24,9 @@ module RuboCop
       # shape loses data identically for any chain longer than one link
       # (`a->b->c->a`), not just a two-element swap.
       #
-      # **The fix this cop points at** — snapshot every old key's value
+      # ## The fix this cop points at
+      #
+      # Snapshot every old key's value
       # first, delete all old keys, then write all new keys, so no
       # rename in the pass ever reads a key this same pass has already
       # written:
@@ -32,7 +36,9 @@ module RuboCop
       #   snapshot.each { |old_name, _new_name, _value| state.delete(old_name) }
       #   snapshot.each { |_old_name, new_name, value| state[new_name] = value }
       #
-      # **What this cop does not attempt** — the general checklist item is
+      # ## What this cop does not attempt
+      #
+      # The general checklist item is
       # broader than any AST pattern can safely automate ("any method
       # that both reads and writes the same collection across a loop"
       # covers plenty of correct code too — accumulating into a result
@@ -84,6 +90,10 @@ module RuboCop
           (send $_recv :[]= _new_key (send $_recv2 :delete _old_key))
         PATTERN
 
+        # Flags a `recv[new] = recv.delete(old)` write inside a loop, same receiver both sides.
+        #
+        # @param node [RuboCop::AST::SendNode] the `[]=` send node being visited
+        # @return [void]
         def on_send(node)
           rename_write?(node) do |recv, recv2|
             next unless same_receiver?(recv, recv2)

data/lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb

@@ -9,17 +9,21 @@ module RuboCop
       # shared, mutable state with no per-thread or mutex-guarded
       # isolation at all.
       #
+      # ## The bug this follows up on
+      #
       # This is the mechanical follow-up to a real bug already fixed here
       # (see `dispatcher.rb`'s own `#reenter` comment, and
-      # `spec/runtime/dispatcher_spec.rb`): `@reaction_depth` used to be a
-      # plain ivar on `Dispatcher`, so two threads' concurrent top-level
-      # dispatches corrupted each other's view of "how deep into a
+      # `spec/runtime/dispatcher_spec.rb`): a plain `@reaction_depth` ivar on
+      # `Dispatcher` let two threads' concurrent top-level
+      # dispatches corrupt each other's view of "how deep into a
       # reaction cascade am I". The fix moved that one ivar to
       # `Thread.current[:hecks_reaction_depth]`. This cop exists so the
       # next plain ivar someone adds to either class gets flagged before
       # it becomes the next instance of the same bug, rather than after.
       #
-      # **Scoped narrowly on purpose** — by class name
+      # ## Scoped narrowly on purpose
+      #
+      # By class name
       # (`Hecks::Runtime::Dispatcher`/`Hecks::Runtime::Registry`), not by
       # blanket-flagging every ivar mutation in the codebase. Most classes
       # in this codebase are not shared across threads (a fresh value
@@ -29,7 +33,9 @@ module RuboCop
       # same reasoning `.rubocop.yml`'s own header gives for every other
       # cop in this repo.
       #
-      # What counts as "PLAIN": `@ivar = ...`, `@ivar ||= ...`, `@ivar +=
+      # ## What counts as "plain"
+      #
+      # `@ivar = ...`, `@ivar ||= ...`, `@ivar +=
       # ...`, `@ivar << ...`, `@ivar[k] = v`. `initialize` is exempt — an
       # ivar being set up for the first time, before any other thread can
       # possibly hold a reference to this object, is not the hazard (see
@@ -67,6 +73,10 @@ module RuboCop
 
         RESTRICT_ON_SEND = [:<<, :[]=].freeze
 
+        # Flags a plain `@ivar = ...` assignment inside a thread-shared class.
+        #
+        # @param node [RuboCop::AST::IvasgnNode] the ivar-assignment node being visited
+        # @return [void]
         def on_ivasgn(node)
           # A plain `@x = 1` parses as `(ivasgn :@x (int 1))` — two
           # children. The commissioner also visits the bare `(ivasgn :@x)`
@@ -79,6 +89,11 @@ module RuboCop
           check(node, node.children.first)
         end
 
+        # Flags a plain `@ivar += ...` (or similar) compound assignment inside a
+        # thread-shared class.
+        #
+        # @param node [RuboCop::AST::OpAsgnNode] the compound-assignment node being visited
+        # @return [void]
         def on_op_asgn(node)
           # `@x += 1` parses as `(op_asgn (ivasgn :@x) :+ (int 1))` — the
           # target is an `ivasgn` node carrying just the name (no value
@@ -89,10 +104,19 @@ module RuboCop
           check(node, ivar_node.children.first)
         end
 
+        # Flags a plain `@ivar ||= ...` assignment inside a thread-shared class.
+        #
+        # @param node [RuboCop::AST::OrAsgnNode] the `||=` assignment node being visited
+        # @return [void]
         def on_or_asgn(node)
           on_op_asgn(node)
         end
 
+        # Flags a plain `@ivar << ...` or `@ivar[k] = v` mutation inside a thread-shared
+        # class.
+        #
+        # @param node [RuboCop::AST::SendNode] the `<<` or `[]=` send node being visited
+        # @return [void]
         def on_send(node)
           return unless RESTRICT_ON_SEND.include?(node.method_name)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-19 00:00:00.000000000 Z
+date: 2026-09-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -55,6 +55,8 @@ files:
 - lib/hecks/adapters/driven/identity_registry.adapter
 - lib/hecks/adapters/driven/identity_registry.rb
 - lib/hecks/adapters/driven/in_memory_ordering.rb
+- lib/hecks/adapters/driven/in_process_key_vault.adapter
+- lib/hecks/adapters/driven/in_process_key_vault.rb
 - lib/hecks/adapters/driven/lambda.adapter
 - lib/hecks/adapters/driven/lambda.rb
 - lib/hecks/adapters/driven/lambda/client.rb
@@ -83,6 +85,8 @@ files:
 - lib/hecks/adapters/driven/sqlite/schema_builder.rb
 - lib/hecks/adapters/driven/system_clock.adapter
 - lib/hecks/adapters/driven/system_clock.rb
+- lib/hecks/adapters/driven/tenant_provisioner.adapter
+- lib/hecks/adapters/driven/tenant_provisioner.rb
 - lib/hecks/adapters/driving/github_webhook.rb
 - lib/hecks/behaviors.rb
 - lib/hecks/behaviors/dsl.rb
@@ -184,14 +188,11 @@ files:
 - lib/hecks/bluebook/translation.rb
 - lib/hecks/bluebook/value_object.rb
 - lib/hecks/codemod.rb
-- lib/hecks/codemod/legacy_dispatch_args.rb
-- lib/hecks/codemod/legacy_dispatch_recorder.rb
 - lib/hecks/construct.rb
 - lib/hecks/corpus.rb
 - lib/hecks/deploy/bluebook/deploy.bluebook
 - lib/hecks/deploy/bluebook/deploy.hecksagon
 - lib/hecks/deploy/oidc.json
-- lib/hecks/deprecation.rb
 - lib/hecks/doc/reference.rb
 - lib/hecks/embryonaut_bluebook.rb
 - lib/hecks/facade.rb
@@ -226,6 +227,7 @@ files:
 - lib/hecks/framework/bluebook/framework.hecksagon
 - lib/hecks/framework/bluebook/governance.bluebook
 - lib/hecks/framework/bluebook/identity.bluebook
+- lib/hecks/framework/bluebook/privacy.bluebook
 - lib/hecks/framework/oidc.json
 - lib/hecks/freezer.rb
 - lib/hecks/fuzzing.rb
@@ -320,6 +322,8 @@ files:
 - lib/hecks/ports/identity_generation.rb
 - lib/hecks/ports/identity_resolution.port
 - lib/hecks/ports/identity_resolution.rb
+- lib/hecks/ports/key_vault.port
+- lib/hecks/ports/key_vault.rb
 - lib/hecks/ports/loading.port
 - lib/hecks/ports/loading.rb
 - lib/hecks/ports/persistence.port
@@ -472,6 +476,8 @@ files:
 - lib/hecks/runtime/value/entity_list_coercion.rb
 - lib/hecks/runtime/value/invariant_violation.rb
 - lib/hecks/storehouse.rb
+- lib/hecks/tenancy/bluebook/tenancy.bluebook
+- lib/hecks/tenancy/bluebook/tenancy.hecksagon
 - lib/hecks/version.rb
 - lib/hecks/vocabulary.rb
 - lib/rubocop/cop/hecks/fallback_hash_lookup.rb