hecks 1.5.1 → 2.0.0

data/lib/hecks/projections/deploy/fargate.rb

@@ -21,9 +21,13 @@ module Hecks
       # `AWS::ECS::TaskDefinition` (`RequiresCompatibilities: [FARGATE]`,
       # `NetworkMode: awsvpc`) running one container built from the
       # domain's own `rust/host`, an `AWS::ECS::Service` behind an
-      # Application Load Balancer, and least-privilege task execution/task
-      # roles — plus the same private VPC/RDS-or-Aurora instance and
-      # temporary era-minting bastion `Lambda` generates, via `Shared`.
+      # Application Load Balancer fronted by an `AWS::CloudFront::
+      # Distribution` (real HTTPS, and a `DefaultCacheBehavior` pinned to
+      # Managed-CachingDisabled — see that resource's own comment for
+      # why nothing more permissive is a safe default here), and
+      # least-privilege task execution/task roles — plus the same private
+      # VPC/RDS-or-Aurora instance and temporary era-minting bastion
+      # `Lambda` generates, via `Shared`.
       #
       # No SAM: this is deployed with plain `aws cloudformation deploy`,
       # never `sam deploy`, so there is no `samconfig.toml` here. A
@@ -35,13 +39,28 @@ module Hecks
       #
       # ## What this assumes, and does not build
       #
-      # `rust/host` running as a long-lived HTTP server on this domain's
-      # own `port`, rather than as a Lambda custom-runtime process
-      # (`bootstrap`, `Lambda`'s own binary), is a real, separate
-      # capability this target assumes exists — not one this generator
-      # builds. The generated `ContainerDefinitions` and target group both
-      # assume the container answers plain HTTP on `port`; wiring that
-      # serve loop into `rust/host/src/main.rs` is future, undone work.
+      # `rust/host` runs as a long-lived HTTP server on this domain's own
+      # `port` here, not as a Lambda custom-runtime process (`bootstrap`,
+      # `Lambda`'s own binary): `HECKS_SERVE_MODE: "1"` (below, in
+      # `ContainerDefinitions[0].Environment`) is `rust/host/src/main.rs`'s
+      # own top-of-`main` switch into `server.rs`'s axum-based server,
+      # which answers this stack's own `GET /` health check with a bare,
+      # dispatch-free `200` and routes every other request through the
+      # same per-invocation dispatch logic the Lambda target's `bootstrap`
+      # binary already runs — see `server.rs`'s own header for the
+      # concurrency reasoning (the boot-time Postgres client is already
+      # `Arc<Mutex<...>>`-shared, and already anticipated exactly this,
+      # per `dispatch.rs`'s own comment on `handle`'s locking).
+      #
+      # Sidecars and ARM64 are generated, not assumed: the Dockerfile
+      # COPYs `#{domain_name}.wasm`/`.ir.json` next to the host binary,
+      # the task sets `HECKS_WASM_PATH`/`HECKS_IR_PATH`, RuntimePlatform
+      # is ARM64, and the Makefile cross-compiles with
+      # aarch64-unknown-linux-gnu (plus the GNU cross-linker on macOS).
+      # A Shared-mode ALB sits in OwningPublicSubnetAId/BId — the private
+      # pair is unreachable from the internet (found live,
+      # lifeadelics-platform). SessionSecret is always minted: HECKS_SERVE_MODE
+      # always runs web.rs, which panics on an empty SESSION_SECRET.
       module Fargate
         extend Projector::Target
 
@@ -115,6 +134,15 @@ module Hecks
           port     = target.state[:port].value
           aurora   = database == "Aurora"
           shared   = database == "Shared"
+          rust_web = target.state[:web].value == "Rust"
+          # Same file-presence convention Lambda uses: `.env.local` is the
+          # domain's own gitignored secrets file; `make sync-google-oauth`
+          # (Lambda) owns the secret's lifecycle. Fargate only needs to
+          # *declare* GOOGLE_OAUTH_SECRET_ID + a redirect URI parameter —
+          # the secret itself is never a stack resource.
+          google_oauth_present = rust_web &&
+                                 File.exist?(File.join(domain, ".env.local")) &&
+                                 File.read(File.join(domain, ".env.local")).match?(/^GOOGLE_CLIENT_ID=\S/)
 
           # Every policy in every loaded chapter — see `Lambda.call`'s own
           # comment on why this reads the whole registry, not only this
@@ -192,6 +220,8 @@ module Hecks
           alb_id             = "#{logical_id}Alb"
           alb_sg_id          = "#{logical_id}AlbSecurityGroup"
           listener_id        = "#{logical_id}Listener"
+          distribution_id    = "#{logical_id}Distribution"
+          session_secret_id  = "#{logical_id}SessionSecret"
 
           stack_outputs = Shared.stack_outputs(
             shared: shared, db_id: db_id, db_ref_id: db_ref_id, secret_intrinsic: secret_intrinsic,
@@ -200,6 +230,40 @@ module Hecks
           bastion_parameters = Shared.bastion_parameters(shared: shared, google_oauth_present: network_needs_internet)
           Shared.check_bastion_parameters!(bastion_parameters, stack_outputs)
 
+          always_params_yaml = <<~ALWAYSPARAMS.rstrip
+            ImageTag:
+              Type: String
+              Default: latest
+              Description: ECR image tag this task pulls — never hardcode latest in the TaskDefinition; a first deploy and a later rollout share this one parameter.
+          ALWAYSPARAMS
+          oauth_params_yaml = google_oauth_present ? <<~OAUTHPARAMS.rstrip : ""
+            # Same chicken-egg as Lambda's WebRedirectBaseUrl — CloudFront's
+            # hostname does not exist until this stack does. Empty on a true
+            # first deploy; `make deploy` looks up Outputs.CloudFrontDomain
+            # after and self-heals.
+            WebRedirectBaseUrl:
+              Type: String
+              Default: ""
+          OAUTHPARAMS
+          # Built outside the template heredoc so Layout/HeredocIndentation
+          # cannot re-indent YAML that must match SessionSecretRead / env.
+          # First interpolated line sits at the `\#{...}` column; later lines
+          # get that same left pad (lambda.rb's own OAUTHPOLICY pattern).
+          oauth_task_policy_yaml = google_oauth_present ? <<~OAUTHPOLICY.rstrip : ""
+            - PolicyName: GoogleOauthSecretRead
+              PolicyDocument:
+                Version: '2012-10-17'
+                Statement:
+                  - Effect: Allow
+                    Action: secretsmanager:GetSecretValue
+                    Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:#{stack_name}-web-google-oauth-*"
+          OAUTHPOLICY
+          oauth_task_env_yaml = google_oauth_present ? <<~OAUTHENV.rstrip : ""
+            - Name: GOOGLE_OAUTH_SECRET_ID
+              Value: #{stack_name}-web-google-oauth
+            - Name: GOOGLE_REDIRECT_URI
+              Value: !Sub "${WebRedirectBaseUrl}/auth/google/callback"
+          OAUTHENV
           owning_params_yaml = shared ? <<~SHAREDPARAMS.rstrip : ""
             # The storehouse — #{owner_domain_name}'s own live stack Outputs,
             # looked up at deploy time (the generated Makefile's own `deploy:`
@@ -212,6 +276,22 @@ module Hecks
               Type: AWS::EC2::Subnet::Id
             OwningSubnetBId:
               Type: AWS::EC2::Subnet::Id
+            # PUBLIC subnets, NOT OwningSubnetAId/OwningSubnetBId above — a
+            # real, live deploy (lifeadelics-platform) found the ALB placed in
+            # the private pair creates successfully and reports its target
+            # health as healthy (health checks run from inside the VPC), yet
+            # is completely unreachable from outside it:
+            # OwningSubnetAId/OwningSubnetBId have MapPublicIpOnLaunch: false
+            # and no Internet Gateway route. These two — resolved from the
+            # owner stack's own PublicSubnetId/BastionSubnetId Outputs,
+            # MapPublicIpOnLaunch: true with a real 0.0.0.0/0 -> igw route —
+            # are the pair that actually works for an internet-facing ALB.
+            # Service.NetworkConfiguration below still (correctly) uses the
+            # private pair for the tasks themselves — only the ALB moves.
+            OwningPublicSubnetAId:
+              Type: AWS::EC2::Subnet::Id
+            OwningPublicSubnetBId:
+              Type: AWS::EC2::Subnet::Id
             OwningSecurityGroupId:
               Type: AWS::EC2::SecurityGroup::Id
             OwningDatabaseEndpoint:
@@ -219,6 +299,7 @@ module Hecks
             OwningDatabaseSecretArn:
               Type: String
           SHAREDPARAMS
+          parameters_yaml = [always_params_yaml, oauth_params_yaml, owning_params_yaml].reject(&:empty?).join("\n")
 
           template_yaml = <<~YAML
             # GENERATED by bin/project_deploy #{domain} — re-run it to refresh
@@ -235,7 +316,7 @@ module Hecks
               #{infra_name} — dispatched through hecks's rust/host, running as a
               long-lived container on AWS Fargate, backed by its own private RDS
               Postgres instance.
-            #{owning_params_yaml.empty? ? "" : "Parameters:\n" + owning_params_yaml.each_line.map { |l| "  #{l}" }.join}
+            #{parameters_yaml.empty? ? "" : "Parameters:\n" + parameters_yaml.each_line.map { |l| "  #{l}" }.join}
             Resources:
               #{shared ? "" : Shared.vpc_and_database_yaml(
                 db_id: db_id, db_name: db_name, infra_name: infra_name, aurora: aurora,
@@ -247,12 +328,25 @@ module Hecks
                 Type: AWS::EC2::SecurityGroup
                 Properties:
                   VpcId: #{shared ? "!Ref OwningVpcId" : "!Ref #{db_id}Vpc"}
-                  GroupDescription: #{alb_sg_id} - public HTTP ingress, forwarded to #{logical_id} only
+                  GroupDescription: #{alb_sg_id} - HTTP ingress from CloudFront only, forwarded to #{logical_id} only
                   SecurityGroupIngress:
+                    # pl-3b927c52 — com.amazonaws.global.cloudfront.origin-
+                    # facing, AWS's own global, account-agnostic managed
+                    # prefix list (confirmed: `aws ec2 describe-managed-
+                    # prefix-lists`, OwnerId "AWS", same id in every
+                    # account/region). NOT 0.0.0.0/0 — the whole reason
+                    # #{distribution_id} above exists is Managed-
+                    # CachingDisabled on every session-cookie-driven
+                    # route; leaving the ALB itself open to the public
+                    # internet on this same port would let anyone bypass
+                    # that distribution (and its HTTPS) entirely and hit
+                    # the plain-HTTP origin directly — the exact gap a
+                    # code review caught the first time this resource was
+                    # added.
                     - IpProtocol: tcp
                       FromPort: 80
                       ToPort: 80
-                      CidrIp: 0.0.0.0/0
+                      SourcePrefixListId: pl-3b927c52
 
               #{logical_id}IngressFromAlb:
                 Type: AWS::EC2::SecurityGroupIngress
@@ -281,6 +375,19 @@ module Hecks
                   LogGroupName: /ecs/#{stack_name}
                   RetentionInDays: 30
 
+              # Always minted — HECKS_SERVE_MODE always runs web.rs, which
+              # panics on an empty SESSION_SECRET (found live: hecksagain-pizzas
+              # 502 after the Aurora cutover). rust/host fetches this at cold
+              # start (secrets.rs), never a plain env var.
+              #{session_secret_id}:
+                Type: AWS::SecretsManager::Secret
+                Properties:
+                  GenerateSecretString:
+                    SecretStringTemplate: '{}'
+                    GenerateStringKey: session_secret
+                    PasswordLength: 64
+                    ExcludePunctuation: true
+
               # Pulls the image and writes CloudWatch Logs — AWS's own managed
               # AmazonECSTaskExecutionRolePolicy already covers both (ECR auth
               # + GetDownloadUrlForLayer, and logs:CreateLogStream/PutLogEvents);
@@ -330,6 +437,14 @@ module Hecks
                           - Effect: Allow
                             Action: secretsmanager:GetSecretValue
                             Resource: !Sub "${#{db_secret_ref}}"
+                    - PolicyName: SessionSecretRead
+                      PolicyDocument:
+                        Version: '2012-10-17'
+                        Statement:
+                          - Effect: Allow
+                            Action: secretsmanager:GetSecretValue
+                            Resource: !Ref #{session_secret_id}
+                    #{oauth_task_policy_yaml.each_line.with_index.map { |l, i| i.zero? ? l : "                    " + l }.join}
                     # TMPL:cross_domain_fargate_policies
 
               #{task_definition_id}:
@@ -338,13 +453,22 @@ module Hecks
                   Family: #{infra_name}
                   RequiresCompatibilities: [FARGATE]
                   NetworkMode: awsvpc
+                  # ARM64, not Fargate's own x86_64 default — matching the
+                  # generated Makefile's own aarch64-unknown-linux-gnu build
+                  # (below) and Lambda's own arm64 toolchain this reuses; a
+                  # container built for the wrong arch fails at task start,
+                  # not at build time, so this has to agree with the image
+                  # docker-build actually pushes.
+                  RuntimePlatform:
+                    CpuArchitecture: ARM64
+                    OperatingSystemFamily: LINUX
                   Cpu: "#{cpu}"
                   Memory: "#{memory}"
                   ExecutionRoleArn: !GetAtt #{execution_role_id}.Arn
                   TaskRoleArn: !GetAtt #{task_role_id}.Arn
                   ContainerDefinitions:
                     - Name: #{infra_name}
-                      Image: !Sub "${#{ecr_repository_id}.RepositoryUri}:latest"
+                      Image: !Sub "${#{ecr_repository_id}.RepositoryUri}:${ImageTag}"
                       PortMappings:
                         - ContainerPort: #{port}
                       LogConfiguration:
@@ -360,19 +484,46 @@ module Hecks
                           Value: "1"
                         - Name: PORT
                           Value: "#{port}"
+                        # `rust/host/src/server.rs`'s own top-of-`main`
+                        # switch — without it, this container runs as the
+                        # Lambda custom-runtime process `Lambda`'s own
+                        # generated binary always has, which blocks
+                        # forever polling a Runtime API that doesn't exist
+                        # here, never answering the health check or
+                        # anything else on `port`.
+                        - Name: HECKS_SERVE_MODE
+                          Value: "1"
                         # `web "Rust"` vs `web "None"` is otherwise inert
                         # here today — both modes generate the identical
                         # task/service/target-group shape, since a Fargate
                         # task always answers HTTP on `port` for dispatch
                         # requests either way. Passed through so
-                        # `rust/host`'s own future long-lived server loop
-                        # (this module's own header names the gap) can read
-                        # it and decide whether to also serve the public
-                        # web UI in-process, the same `web`-shaped choice
-                        # `Lambda`'s own `rust_web` already makes for the
-                        # Lambda path.
+                        # `rust/host`'s own server loop (server.rs) can
+                        # read it and decide whether to also serve the
+                        # public web UI in-process, the same `web`-shaped
+                        # choice `Lambda`'s own `rust_web` already makes
+                        # for the Lambda path.
                         - Name: HECKS_WEB
                           Value: #{target.state[:web].value}
+                        # HECKS_WASM_PATH/HECKS_IR_PATH — main.rs requires
+                        # both unconditionally at boot (ir::ir().ok_or(...)?,
+                        # no fallback, and HECKS_WASM_PATH for every
+                        # dispatch) regardless of `web`/HECKS_SERVE_MODE. A
+                        # container built with neither set crashes before
+                        # ever reaching its own serve loop — found live
+                        # deploying lifeadelics-platform's own domain
+                        # container, fixed here so every Fargate domain ships
+                        # both sidecars by default. Paths match the
+                        # Dockerfile's own COPY destinations, below.
+                        - Name: HECKS_WASM_PATH
+                          Value: /usr/local/bin/#{domain_name}.wasm
+                        - Name: HECKS_IR_PATH
+                          Value: /usr/local/bin/#{domain_name}.ir.json
+                        - Name: SESSION_SECRET_ARN
+                          Value: !Ref #{session_secret_id}
+                        - Name: HECKS_CHECKOUT_DOMAIN
+                          Value: #{declared_domain_name}
+                        #{oauth_task_env_yaml.each_line.with_index.map { |l, i| i.zero? ? l : "                        " + l }.join}
                         # TMPL:db_env
 
               #{target_group_id}:
@@ -392,7 +543,7 @@ module Hecks
                   Scheme: internet-facing
                   Type: application
                   SecurityGroups: [!Ref #{alb_sg_id}]
-                  Subnets: #{shared ? "[!Ref OwningSubnetAId, !Ref OwningSubnetBId]" : "[!Ref #{db_id}PublicSubnet, !Ref #{db_id}BastionPublicSubnet]"}
+                  Subnets: #{shared ? "[!Ref OwningPublicSubnetAId, !Ref OwningPublicSubnetBId]" : "[!Ref #{db_id}PublicSubnet, !Ref #{db_id}BastionPublicSubnet]"}
 
               #{listener_id}:
                 Type: AWS::ElasticLoadBalancingV2::Listener
@@ -423,9 +574,76 @@ module Hecks
                       ContainerPort: #{port}
                       TargetGroupArn: !Ref #{target_group_id}
 
+              # Real HTTPS (the ALB's own Listener above is HTTP-only —
+              # nothing else in this stack terminates TLS) and, just as
+              # important, the ONE safe default this generator can offer
+              # for caching it has no way to reason about: Managed-
+              # CachingDisabled. This domain's own routes — including
+              # every hecks-native /login, /logout, /auth/google(/callback),
+              # /admin/members request (web.rs's own auth_gate/auth_route,
+              # generic across every domain, not just this one's own
+              # dispatch commands) — are all session-cookie-driven, and
+              # this generator has no way to tell which of a domain's own
+              # paths would ever be safe to cache. Found live, the hard
+              # way (lifeadelics, 2026-09-21): a hand-authored CloudFront
+              # stack applied the OPPOSITE default — a custom, cookie-
+              # blind cache policy with a 90-120s TTL — and it served one
+              # signed-in session's own response (a short-lived SSO
+              # handoff token among them) back to a different, unrelated
+              # request within that window. A domain that DOES know one
+              # of its own paths is genuinely safe to cache (a public,
+              # non-personalized page) adds its own more specific
+              # CacheBehavior by hand, the same way lifeadelics's own
+              # hand-extended three-container stack already does for
+              # /_astro/*, /videos/*, and friends — never by loosening
+              # this one.
+              #{distribution_id}:
+                Type: AWS::CloudFront::Distribution
+                Properties:
+                  DistributionConfig:
+                    Enabled: true
+                    HttpVersion: http2
+                    # No ACM/custom domain here — this generator has no
+                    # notion of one (deploy.bluebook's own FargateTarget
+                    # declares no `domain` attribute for it) and CloudFront
+                    # requires an ACM cert in us-east-1 specifically to
+                    # attach a custom Aliases entry, a real cross-region
+                    # dependency this generator can't assume. CloudFront's
+                    # own default *.cloudfront.net certificate/hostname
+                    # are what Outputs.CloudFrontDomain below reports;
+                    # point a real domain's DNS at it by hand, same
+                    # "generated, extend by hand" posture this whole file
+                    # already has for anything past its own baseline.
+                    ViewerCertificate:
+                      CloudFrontDefaultCertificate: true
+                    Origins:
+                      - Id: #{alb_id}Origin
+                        DomainName: !GetAtt #{alb_id}.DNSName
+                        CustomOriginConfig:
+                          OriginProtocolPolicy: http-only
+                          HTTPPort: 80
+                          HTTPSPort: 443
+                    DefaultCacheBehavior:
+                      TargetOriginId: #{alb_id}Origin
+                      ViewerProtocolPolicy: redirect-to-https
+                      Compress: true
+                      AllowedMethods: [GET, HEAD, OPTIONS, PUT, PATCH, POST, DELETE]
+                      CachedMethods: [GET, HEAD]
+                      # Managed-CachingDisabled — see this resource's own
+                      # header comment for why nothing else is safe here
+                      # by default.
+                      CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
+                      # Managed-AllViewer — forwards every cookie/header/
+                      # query string through uncached, so rust/host's own
+                      # session-cookie-based auth sees the real request
+                      # exactly as the browser sent it.
+                      OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3
+
             Outputs:
               ServiceUrl:
                 Value: !Sub "http://${#{alb_id}.DNSName}"
+              CloudFrontDomain:
+                Value: !GetAtt #{distribution_id}.DomainName
               #{stack_outputs.map { |o| "#{o[:key]}:\n    Value: #{o[:ref]}" }.join("\n  ")}
           YAML
 
@@ -471,6 +689,11 @@ module Hecks
                 && rm -rf /var/lib/apt/lists/*
 
             COPY #{domain_name}-host /usr/local/bin/#{domain_name}-host
+            # The .wasm/.ir.json sidecars main.rs requires at boot —
+            # HECKS_WASM_PATH/HECKS_IR_PATH (template.yaml's own
+            # ContainerDefinitions Environment) point at these exact paths.
+            COPY #{domain_name}.wasm /usr/local/bin/#{domain_name}.wasm
+            COPY #{domain_name}.ir.json /usr/local/bin/#{domain_name}.ir.json
 
             ENV PORT=#{port}
             ENV BIND=0.0.0.0
@@ -495,9 +718,30 @@ module Hecks
             IMAGE_TAG  := latest
 
             build:
-            \t@rustup target list --installed 2>/dev/null | grep -qx x86_64-unknown-linux-gnu || rustup target add x86_64-unknown-linux-gnu
-            \tcd $(ROOT)/rust/host && rustup run stable cargo build --release --target x86_64-unknown-linux-gnu
-            \tcp $(ROOT)/rust/host/target/x86_64-unknown-linux-gnu/release/bootstrap #{domain_name}-host
+            # aarch64, not x86_64 — matches template.yaml's own
+            # RuntimePlatform: ARM64 (this Makefile has to build the same
+            # architecture the task definition declares, or the container
+            # fails at task start, not at build time), and reuses the same
+            # working aarch64-unknown-linux-gnu toolchain the Lambda deploy
+            # path already depends on, rather than standing up a second,
+            # x86_64-only one.
+            \t@rustup target list --installed 2>/dev/null | grep -qx aarch64-unknown-linux-gnu || rustup target add aarch64-unknown-linux-gnu
+            # GNU cross-linker, not Apple clang — rustc's aarch64-unknown-linux-gnu
+            # target emits `-Wl,--fix-cortex-a53-843419`, which macOS ld rejects
+            # (found live building lifeadelics-platform's domain image). Same
+            # toolchain Lambda's generated Makefile already documents.
+            \t@command -v aarch64-linux-gnu-gcc >/dev/null 2>&1 || { echo "aarch64-linux-gnu-gcc isn't on PATH. Install once with: brew tap messense/macos-cross-toolchains && brew install aarch64-unknown-linux-gnu"; exit 1; }
+            # The .wasm/.ir.json sidecars main.rs requires at boot,
+            # unconditionally — see template.yaml's own HECKS_WASM_PATH/
+            # HECKS_IR_PATH comment for why. bin/project_wasm is the same
+            # generator the Lambda deploy path already uses to produce
+            # rust/dist/#{domain_name}.wasm/.ir.json from this domain's own
+            # .bluebook.
+            \tcd $(ROOT) && bin/project_wasm $(DOMAIN)
+            \tcd $(ROOT)/rust/host && CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc rustup run stable cargo build --release --target aarch64-unknown-linux-gnu --bin bootstrap
+            \tcp $(ROOT)/rust/host/target/aarch64-unknown-linux-gnu/release/bootstrap #{domain_name}-host
+            \tcp $(ROOT)/rust/dist/#{domain_name}.wasm #{domain_name}.wasm
+            \tcp $(ROOT)/rust/dist/#{domain_name}.ir.json #{domain_name}.ir.json
 
             .PHONY: ecr-login
             ecr-login:
@@ -505,7 +749,10 @@ module Hecks
 
             .PHONY: docker-build
             docker-build: build
-            \tdocker build --platform linux/amd64 -t #{infra_name}:$(IMAGE_TAG) .
+            # linux/arm64, not the generator's old amd64 default — has to
+            # match RuntimePlatform/the binary this Makefile's own build:
+            # step just cross-compiled, above.
+            \tdocker build --platform linux/arm64 -t #{infra_name}:$(IMAGE_TAG) .
 
             .PHONY: docker-push
             docker-push: ecr-login
@@ -515,7 +762,7 @@ module Hecks
 
             .PHONY: deploy
             deploy: docker-build docker-push
-            #{shared ? "\t@echo \"Looking up #{owner_stack_name}'s shared VpcId/PrivateSubnetAId/PrivateSubnetBId/FunctionSecurityGroupId/DatabaseEndpoint/DatabaseSecretArn outputs to pass as $(STACK)'s Owning* parameters...\"\n\tOWNER_VPC_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='VpcId'].OutputValue\" --output text); \\\n\t\tOWNER_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='PrivateSubnetAId'].OutputValue\" --output text); \\\n\t\tOWNER_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='PrivateSubnetBId'].OutputValue\" --output text); \\\n\t\tOWNER_SG_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='FunctionSecurityGroupId'].OutputValue\" --output text); \\\n\t\tOWNER_DB_HOST=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='DatabaseEndpoint'].OutputValue\" --output text); \\\n\t\tOWNER_DB_SECRET_ARN=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='DatabaseSecretArn'].OutputValue\" --output text); \\\n\t\taws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM \\\n\t\t\t--parameter-overrides OwningVpcId=$$OWNER_VPC_ID OwningSubnetAId=$$OWNER_SUBNET_A_ID OwningSubnetBId=$$OWNER_SUBNET_B_ID OwningSecurityGroupId=$$OWNER_SG_ID OwningDatabaseEndpoint=$$OWNER_DB_HOST OwningDatabaseSecretArn=$$OWNER_DB_SECRET_ARN" : "\taws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM"}
+            #{shared ? "\t@echo \"Looking up #{owner_stack_name}'s shared VpcId/PrivateSubnetAId/PrivateSubnetBId/PublicSubnetId/BastionSubnetId/FunctionSecurityGroupId/DatabaseEndpoint/DatabaseSecretArn outputs to pass as $(STACK)'s Owning* parameters...\"\n\tOWNER_VPC_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='VpcId'].OutputValue\" --output text); \\\n\t\tOWNER_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='PrivateSubnetAId'].OutputValue\" --output text); \\\n\t\tOWNER_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='PrivateSubnetBId'].OutputValue\" --output text); \\\n\t\tOWNER_PUBLIC_SUBNET_A_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='PublicSubnetId'].OutputValue\" --output text); \\\n\t\tOWNER_PUBLIC_SUBNET_B_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='BastionSubnetId'].OutputValue\" --output text); \\\n\t\tOWNER_SG_ID=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='FunctionSecurityGroupId'].OutputValue\" --output text); \\\n\t\tOWNER_DB_HOST=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='DatabaseEndpoint'].OutputValue\" --output text); \\\n\t\tOWNER_DB_SECRET_ARN=$$(aws cloudformation describe-stacks --stack-name #{owner_stack_name} --query \"Stacks[0].Outputs[?OutputKey=='DatabaseSecretArn'].OutputValue\" --output text); \\\n\t\taws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM \\\n\t\t\t--parameter-overrides ImageTag=$(IMAGE_TAG) OwningVpcId=$$OWNER_VPC_ID OwningSubnetAId=$$OWNER_SUBNET_A_ID OwningSubnetBId=$$OWNER_SUBNET_B_ID OwningPublicSubnetAId=$$OWNER_PUBLIC_SUBNET_A_ID OwningPublicSubnetBId=$$OWNER_PUBLIC_SUBNET_B_ID OwningSecurityGroupId=$$OWNER_SG_ID OwningDatabaseEndpoint=$$OWNER_DB_HOST OwningDatabaseSecretArn=$$OWNER_DB_SECRET_ARN" : "\taws cloudformation deploy --template-file template.yaml --stack-name $(STACK) --region $(REGION) --capabilities CAPABILITY_IAM --parameter-overrides ImageTag=$(IMAGE_TAG)"}
             \t$(MAKE) mint-era
 
             #{shared ? <<~SHAREDMINT.rstrip : <<~OWNMINT.rstrip

data/lib/hecks/projections/deploy/lambda.rb

@@ -108,7 +108,7 @@ module Hecks
           # + extraction + memory + prism only) than the one `pending_privacy_
           # markings` was verified against; kept separate rather than assumed
           # equivalent.
-          pii_registry = Hecks::Runtime::Registry.new
+          pii_registry = Hecks::Runtime::Registry.new(root: File.expand_path(domain))
           Hecks.with_registry(pii_registry) do
             bootstrap = Hecks::Ports::Loading.bootstrap
             bluebook_dir = File.join(domain, "bluebook")
@@ -841,7 +841,16 @@ module Hecks
                       # triggers that first boot; a LATER real schema evolution
                       # (era 2+) is a separate, later re-generation, not this one.
                       HECKS_DOMAIN: #{declared_domain_name}
-                      HECKS_ERA: "1"#{hecks_schema ? %(\n          HECKS_SCHEMA: #{hecks_schema}) : ""}#{rust_web ? %(\n          HECKS_IR_PATH: !Sub "/var/task/#{domain_name}.ir.json") : ""}#{rust_web && google_oauth_present ? <<~RUSTOAUTH.each_line.with_index.map { |l, i| i.zero? ? "\n          " + l : "          " + l }.join.rstrip : ""}
+                      # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/main.rs`'s
+                      # own boot sequence reads `ir::ir().ok_or(...)?` for every domain
+                      # regardless of web mode (era-lineage bookkeeping needs the IR, not
+                      # just the optional in-process web UI), so a Shared-mode domain with
+                      # no web layer still needs this sidecar path to boot at all. Previously
+                      # gated on `rust_web`, which left every such domain's Lambda crashing
+                      # on cold start — checkout.rs's own header flagged this exact
+                      # contradiction, confirmed live against Banking's committed template.
+                      HECKS_IR_PATH: !Sub "/var/task/#{domain_name}.ir.json"
+                      HECKS_ERA: "1"#{hecks_schema ? %(\n          HECKS_SCHEMA: #{hecks_schema}) : ""}#{rust_web && google_oauth_present ? <<~RUSTOAUTH.each_line.with_index.map { |l, i| i.zero? ? "\n          " + l : "          " + l }.join.rstrip : ""}
                       # NOT `{{resolve:secretsmanager:...}}` composing
                       # GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET/SESSION_SECRET
                       # directly anymore -- the identical GetFunctionConfiguration
@@ -1893,7 +1902,14 @@ bastion_yaml = shared ? nil : Shared.bastion_yaml(
             # Lambda) the same day this comment was written.
             \tcd $(HOST_DIR) && rustup run stable cargo lambda build --release --arm64
             \tcp $(HOST_DIR)/target/lambda/bootstrap/bootstrap $(ARTIFACTS_DIR)/bootstrap
-            \tcp $(WASM) $(ARTIFACTS_DIR)/#{domain_name}.wasm#{rust_web ? %(\n\tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} $(ARTIFACTS_DIR)/#{domain_name}.ir.json) : ""}
+            # UNCONDITIONAL, not gated on rust_web -- same reason HECKS_IR_PATH
+            # itself is unconditional above: main.rs's own boot sequence reads
+            # the IR for every domain regardless of web mode, so the sidecar
+            # file this env var points to has to actually be in the package
+            # too, or the env var alone just changes the crash from "not set"
+            # to "not found".
+            \tcp $(WASM) $(ARTIFACTS_DIR)/#{domain_name}.wasm
+            \tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} $(ARTIFACTS_DIR)/#{domain_name}.ir.json
 
             # `sam build <resource>` WIPES .aws-sam/build/ entirely before
             # building just the one resource named -- confirmed live: building
@@ -1917,7 +1933,8 @@ bastion_yaml = shared ? nil : Shared.bastion_yaml(
             restore-#{logical_id}-build:
             \t@mkdir -p .aws-sam/build/#{logical_id}
             \tcp $(HOST_DIR)/target/lambda/bootstrap/bootstrap .aws-sam/build/#{logical_id}/bootstrap
-            \tcp $(WASM) .aws-sam/build/#{logical_id}/#{domain_name}.wasm#{rust_web ? %(\n\tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} .aws-sam/build/#{logical_id}/#{domain_name}.ir.json) : ""}
+            \tcp $(WASM) .aws-sam/build/#{logical_id}/#{domain_name}.wasm
+            \tcp #{File.join(root, "rust", "dist", "#{domain_name}.ir.json")} .aws-sam/build/#{logical_id}/#{domain_name}.ir.json
             \truby -e 'lines = File.readlines(".aws-sam/build/template.yaml"); start = lines.index { |l| l.strip == "#{logical_id}:" } or raise "restore-#{logical_id}-build: #{logical_id} resource not found in built template"; idx = (start+1...lines.length).find { |i| lines[i] =~ /CodeUri:/ } or raise "restore-#{logical_id}-build: no CodeUri line found under #{logical_id}"; lines[idx] = lines[idx].sub(/CodeUri:.*/, "CodeUri: #{logical_id}"); File.write(".aws-sam/build/template.yaml", lines.join)'
 
             # `make verify-parity-#{logical_id}` — closes the exact gap the

data/lib/hecks/projector/exporter.rb

@@ -126,6 +126,54 @@ module Hecks
         }
       end
 
+      # Same seam as `authorization` — which chapter answers "who may
+      # sign in" (`Registry#membership_provider_for`), with its declared
+      # verbs qualified and the membership aggregate named off `admit`.
+      # rust/host reads this instead of HECKS_MEMBERSHIP_AGGREGATE.
+      # `{}` when nothing this domain attaches provides membership.
+      # @param registry [Runtime::Registry] the booted registry `domain_name` is loaded in
+      # @param domain_name [String] the domain to export the membership binding for
+      # @return [Hash{Symbol => String, nil}] `:provider` (name), `:admit`, `:grant`,
+      #   `:people` (qualified verbs), and `:aggregate` (`:admit`'s own leading
+      #   aggregate name); `{}` if nothing this domain attaches provides membership
+      def membership(registry, domain_name)
+        provider = registry.membership_provider_for(domain_name)
+        return {} unless provider
+
+        capability = Bluebook::Capabilities::MEMBERSHIP
+        admit = provider.provided_verb(capability, :admit)
+        {
+          provider:  provider.name,
+          admit:     admit,
+          grant:     provider.provided_verb(capability, :grant),
+          people:    provider.provided_verb(capability, :people),
+          aggregate: admit&.split(".")&.first
+        }
+      end
+
+      # Same seam as `authorization` — which chapter answers "who is this
+      # authenticated pair" (`Registry#identity_provider_for`), with its
+      # declared verbs qualified. rust/host reads this instead of naming
+      # Identity::Identity.Register / ExternalIdentifier.Link. `{}` when
+      # nothing this domain attaches provides identity. Breaking in 2.0:
+      # Link's reference field is `identity`, never `identity_id`.
+      # @param registry [Runtime::Registry] the booted registry `domain_name` is loaded in
+      # @param domain_name [String] the domain to export the identity binding for
+      # @return [Hash{Symbol => String, nil}] `:provider` (name), `:register`, `:link`,
+      #   `:resolve` (qualified verbs); `{}` if nothing this domain attaches provides identity
+      def identity(registry, domain_name)
+        provider = registry.identity_provider_for(domain_name)
+        return {} unless provider
+
+        capability = Bluebook::Capabilities::IDENTITY
+        {
+          provider: provider.name,
+          register: provider.provided_verb(capability, :register),
+          link:     provider.provided_verb(capability, :link),
+          resolve:  provider.provided_verb(capability, :resolve)
+        }
+      end
+
       # Translation IR, always as an array, with each aggregate's
       # precompiled SQL attached (`compiled_translation_aggregate`) —
       # this is the export a consumer embeds (`ir.json`'s `translations`

data/lib/hecks/router/namespace_installer.rb

@@ -138,12 +138,22 @@ module Hecks
         current_entries.reject { |entry| entry.fqn.aggregate.nil? }
                        .group_by { |entry| [entry.fqn.aggregate, entry.fqn.verb] }
                        .each do |(aggregate, verb), candidates|
+          # Bounded chapters wrap in their own module (`Domain::Aggregate`)
+          # so two BCs can both declare `Person` without colliding on
+          # Object::Person. Folder-spread files of the SAME chapter still
+          # get the shortcut — they are not BCs.
+          next if bounded_chapter?(candidates)
+
           shortcut_target(aggregate).define_singleton_method(verb) do |**args|
             installer.send(:dispatch_short, candidates, **args)
           end
         end
       end
 
+      def bounded_chapter?(candidates)
+        candidates.any? { |entry| entry.dispatcher.registry.bounded?(entry.fqn.domain) }
+      end
+
       def dispatch_short(candidates, **args)
         if candidates.length > 1
           shown = candidates.map { |entry| entry.fqn.to_s }.sort.join(", ")