hecks 3.0.2 → 3.0.4

data/lib/hecks/tools/gate.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "open3"
+require "yaml"
+require_relative "../tools"
+
+module Hecks
+  module Tools
+    # Runs a stage's checks, which `lib/hecks/gate/stages.yml` holds as data, all at once and
+    # reports every one, so a red check does not hide the others.
+    #
+    #   hecks gate pre_push                # every check of the stage
+    #   hecks gate pre_push only=rubocop   # the named checks
+    #   hecks gate --list                  # the stages and their checks
+    #
+    # A green stage prints which checks passed; a red one prints each failing check's whole output
+    # and what its failure means, and answers status 1.
+    module Gate
+      STAGES_FILE = File.expand_path("../gate/stages.yml", __dir__)
+      USAGE = "usage: hecks gate <stage> [only=a,b] | hecks gate --list"
+
+      module_function
+
+      # @param argv [Array<String>] a stage name and optionally `only=a,b`, or `--list`
+      # @param root [String] the checkout the checks run in
+      # @return [Integer] 0 when every check passed, 1 when one failed, 2 on bad usage
+      def main(argv, root: Tools::ROOT, **)
+        stages = YAML.load_file(STAGES_FILE)
+        return list(stages) if argv == ["--list"]
+
+        name = argv.find { |arg| !arg.include?("=") && !arg.start_with?("--") }
+        only = argv.filter_map { |arg| arg.delete_prefix("only=").split(",") if arg.start_with?("only=") }.flatten
+        stage = stages[name]
+        return usage(stages, name) unless stage
+
+        checks = select(stage.fetch("checks"), only)
+        return unknown(stage, only) if checks.nil?
+
+        report(name, checks, run_all(stage, checks, root))
+      end
+
+      # @param checks [Array<Hash>] a stage's checks
+      # @param only [Array<String>] the check ids asked for; every check when empty
+      # @return [Array<Hash>, nil] the checks to run, nil when an id names no check
+      def select(checks, only)
+        return checks if only.empty?
+        return nil unless (only - checks.map { |check| check["id"] }).empty?
+
+        checks.select { |check| only.include?(check["id"]) }
+      end
+
+      # Starts every check at once and waits for all of them.
+      #
+      # @param stage [Hash] the stage: its `env` and `checks`
+      # @param checks [Array<Hash>] the checks to run
+      # @param root [String] the directory they run in
+      # @return [Hash{String => Array}] each check's id, and its output and whether it passed
+      def run_all(stage, checks, root)
+        env = stage.fetch("env", {}).reject { |key, _| ENV.key?(key) }
+        threads = checks.map do |check|
+          Thread.new { [check["id"], run_one(check, env, root)] }
+        end
+        threads.to_h(&:value)
+      end
+
+      # @return [Array(String, Boolean)] what the check printed, and whether it exited 0
+      def run_one(check, env, root)
+        argv = check.fetch("run").map { |word| word.to_s.sub("{workers}", workers.to_s) }
+        output, status = Open3.capture2e(env, *argv, chdir: root)
+        [output, status.success?]
+      rescue SystemCallError => e
+        ["could not start #{argv.first}: #{e.message}", false]
+      end
+
+      # @return [Integer] half the machine's cores, at least one; the parallel suite at full width
+      #   starves the fuzzing run beside it
+      def workers
+        require "etc"
+        [Etc.nprocessors / 2, 1].max
+      end
+
+      def report(name, checks, results)
+        failed = checks.reject { |check| results.fetch(check["id"]).last }
+        failed.each do |check|
+          output, = results.fetch(check["id"])
+          puts "\n[gate #{name}] #{check['title']}\n\n#{output}"
+          puts "\n[gate #{name}] BLOCKED: #{check['blocked']}\n"
+        end
+        if failed.empty?
+          puts "[gate #{name}] green: #{checks.map { |check| check['id'] }.join(', ')}"
+          return 0
+        end
+
+        puts "[gate #{name}] red: #{failed.map { |check| check['id'] }.join(', ')}"
+        1
+      end
+
+      def list(stages)
+        stages.each do |name, stage|
+          puts "#{name}: #{stage.fetch('checks').map { |check| check['id'] }.join(', ')}"
+        end
+        0
+      end
+
+      def unknown(stage, only)
+        known = stage.fetch("checks").map { |check| check["id"] }
+        warn "no such check: #{(only - known).join(', ')} (checks: #{known.join(', ')})"
+        2
+      end
+
+      def usage(stages, name)
+        warn(name ? "no such stage: #{name} (stages: #{stages.keys.join(', ')})" : USAGE)
+        2
+      end
+    end
+  end
+end

data/lib/hecks/tools.rb

@@ -19,7 +19,10 @@ module Hecks
       "standardize_comments"           => ["tools/comment_style", "CommentStyle"],
       "standardize_comments_rust"      => ["tools/rust_comment_style", "RustCommentStyle"],
       "regen_codegen_domains"          => ["tools/regeneration_run", "RegenerationRun"],
+      "gate"                           => ["tools/gate", "Gate"],
       "argument_gate_matrix"           => ["tools/argument_gate_matrix", "ArgumentGateMatrix"],
+      "project_ci_gates"               => ["tools/ci_gates", "CiGates"],
+      "decide_ci_gate"                 => ["tools/ci_gate_decision", "CiGateDecision"],
       "project_deploy"                 => ["tools/deploy_recipe", "DeployRecipe"],
       "lint_deploy_recipes"            => ["tools/deploy_recipe_lint", "DeployRecipeLint"],
       "project_oidc"                   => ["tools/oidc_manifests", "OidcManifests"],

data/lib/hecks/version.rb

@@ -1,5 +1,5 @@
 module Hecks
   # Read directly by the gemspec, so this file must never require the
   # rest of the gem (its dependencies aren't resolved yet at that point).
-  VERSION = "3.0.2".freeze
+  VERSION = "3.0.4".freeze
 end

data/lib/hecks/vocabulary.rb

@@ -49,6 +49,10 @@ module Hecks
         {"name"=>"build-dependencies"}.freeze,
         {"name"=>"workspace"}.freeze
       ].freeze,
+      "CiGate" => [
+        {"name"=>"runtime_changed", "workflow"=>"ci.yml", "mode"=>"touches", "pattern"=>"^lib/hecks/runtime/", "push"=>"skip", "label"=>"does this change touch lib/hecks/runtime/**?"}.freeze,
+        {"name"=>"postgres_io_relevant_changed", "workflow"=>"ci-postgres-io-parallel.yml", "mode"=>"skips_unless", "pattern"=>"^(docs/|editors/|release/|deploy/|\\.claude/|\\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests|project)/|rust/project\\.rb$|rust/project_rust_pipeline\\.rb$|\\.rubocop\\.yml$|\\.rubocop_todo\\.yml$|\\.mcp\\.json$|\\.rspec-local\\.example$|README\\.md$|CHANGELOG\\.md$|CONTRIBUTING\\.md$|SECURITY\\.md$|LICENSE$|\\.gitignore$)", "push"=>"before_sha", "label"=>"does this change touch anything rspec_postgres_io_parallel covers?"}.freeze
+      ].freeze,
       "Comparison" => [
         {"symbol"=>">=", "compares_less_than"=>"true", "compares_equal"=>"false", "negated"=>"true"}.freeze,
         {"symbol"=>"<=", "compares_less_than"=>"true", "compares_equal"=>"true", "negated"=>"false"}.freeze,
@@ -123,7 +127,8 @@ module Hecks
       ].freeze,
       "NormalisationStrategy" => [
         {"name"=>"collapse_whitespace"}.freeze,
-        {"name"=>"replace"}.freeze
+        {"name"=>"replace"}.freeze,
+        {"name"=>"scale_call"}.freeze
       ].freeze,
       "Primitive" => [
         {"name"=>"String"}.freeze,

data/lib/hecks.rb

@@ -27,8 +27,7 @@ require_relative "hecks/projector"
 # every target registers itself as it loads, so this require is the
 # installation of them.
 require_relative "hecks/projections"
-# After `Projector` (dispatches against the `:cli` projection) and
-# `Ports::Clock` (fills a staleness rule's `now` at the door) both exist.
+# After `Projector`, which dispatches against the `:cli` projection.
 require_relative "hecks/doors/cli_door"
 require_relative "hecks/doors/cli_runner"
 require_relative "hecks/storehouse"
@@ -76,6 +75,17 @@ module Hecks
       Runtime.describe(path, shared: shared, environment: environment)
     end
 
+    # Finishes a boot from declarations `describe` already loaded, so the domain's files are read
+    # once. See `Runtime::Loader.boot_described`.
+    #
+    # @param described [Runtime::Loader::Described] what `describe` answered
+    # @param install_doors [Boolean] install the `Widget::Item.Add`-style facade
+    # @param install_facade [Boolean, nil] the deprecated spelling of `install_doors`; warns
+    # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] dispatcher bound to the domain
+    def boot_described(described, install_doors: true, install_facade: nil)
+      Runtime.boot_described(described, install_doors: install_doors, install_facade: install_facade)
+    end
+
     # Boots a domain from an explicit list of files (a `.bluebook`, its
     # `.hecksagon`, optionally a `.world`) instead of a whole directory —
     # see `Runtime::Loader.boot_files` for why this exists beside `boot`.

data/rust/build/src/resolve.rs

@@ -94,7 +94,20 @@ fn resolve_json(parser_bin: &Path, chapter_name: &str, hecksagon_path: &Path, ke
     Ok(names.iter().filter_map(Json::as_str).map(str::to_string).collect())
 }
 
+/// `/\A[a-z][a-z0-9_]*\z/` — the shape `hecks vendor` accepts for a package directory name.
+/// The name is joined into a path and, through its chapter, into a directory the build deletes,
+/// so `../x` or an absolute path must never reach either.
+pub fn valid_package_name(name: &str) -> bool {
+    let mut chars = name.chars();
+    matches!(chars.next(), Some(c) if c.is_ascii_lowercase()) && chars.all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_')
+}
+
 pub fn vendored_bluebook_files(domain: &Path, pkg_name: &str) -> Result<Vec<PathBuf>, String> {
+    if !valid_package_name(pkg_name) {
+        return Err(format!(
+            "uses_embryonaut_bluebook {pkg_name:?} is not a package name — it must match [a-z][a-z0-9_]* (the name `hecks vendor` accepts)"
+        ));
+    }
     let dir = domain.join("vendor").join("embryonaut_bluebooks").join(pkg_name).join("bluebook");
     if !dir.is_dir() {
         return Err(format!(
@@ -109,6 +122,18 @@ pub fn vendored_bluebook_files(domain: &Path, pkg_name: &str) -> Result<Vec<Path
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_package_name_that_is_a_path_is_refused_before_any_directory_is_touched() {
+        for name in ["../x", "a/b", "/etc", "", "X", "1st", "a-b", "a b", ".."] {
+            assert!(!valid_package_name(name), "{name:?}");
+            let refusal = vendored_bluebook_files(Path::new("/nonexistent"), name).unwrap_err();
+            assert!(refusal.contains("is not a package name"), "{refusal}");
+        }
+        for name in ["payments", "console_settings", "a1"] {
+            assert!(valid_package_name(name), "{name:?}");
+        }
+    }
+
     #[test]
     fn pascal_cases_snake_case_stems() {
         assert_eq!(pascal("governance"), "Governance");

data/rust/codegen/src/naming.rs

@@ -125,13 +125,15 @@ fn plain_identifier(name: &str) -> bool {
 }
 
 /// Every declared `name` in the IR, in document order. The `fields` maps under `mutations` are
-/// skipped: their keys are attribute names and their values are source text, not declarations.
+/// skipped: their keys are attribute names and their values are source text, not declarations. So is
+/// `translations`: an era edge names data paths (`attendee.first_name`, a backfill into a nested
+/// value object), which the host applies to stored rows and which are never written into Rust.
 fn declared_names<'a>(ir: &'a Json, out: &mut Vec<&'a str>) {
     match ir {
         Json::Object(pairs) => {
             for (key, value) in pairs {
                 match (key.as_str(), value) {
-                    ("fields", _) => {}
+                    ("fields" | "translations", _) => {}
                     ("name", Json::String(name)) => out.push(name),
                     _ => declared_names(value, out),
                 }
@@ -335,6 +337,15 @@ mod tests {
         assert_eq!(unsafe_name_refusal("shop", &ir), None);
     }
 
+    #[test]
+    fn ignores_data_paths_named_by_a_translation_edge() {
+        let ir = Json::parse(
+            r#"{"name":"Shop","aggregates":[{"name":"Pizza"}],"translations":[{"aggregates":[{"name":"Pizza","backfills":[{"name":"attendee.first_name"}]}]}]}"#,
+        )
+        .unwrap();
+        assert_eq!(unsafe_name_refusal("shop", &ir), None);
+    }
+
     #[test]
     fn refuses_an_aggregate_name_that_is_not_a_plain_identifier() {
         assert!(reserved_name_refusal("shop", "shop", &["My-App"]).is_some());

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.0.2
+3.0.4

data/rust/host/src/dispatch.rs

@@ -14,6 +14,61 @@ pub struct Outcome {
     pub accepted: bool,
 }
 
+/// Who a command is dispatched for: the role they state and, when the host knows who they are, the
+/// actor Governance holds assignments for. Both absent is an unidentified caller.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct Caller<'a> {
+    pub role: Option<&'a str>,
+    pub actor_id: Option<&'a str>,
+}
+
+/// The role an unidentified caller is dispatched under when roles are enforced: no command declares
+/// it, so a command that declares any role refuses it.
+pub const ANONYMOUS_ROLE: &str = "Anonymous";
+
+/// What the host does about the role a command declares (`HECKS_ROLE_ENFORCEMENT`).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Enforcement {
+    /// A caller with no role is unchecked, as before.
+    Off,
+    /// An unidentified or unassigned caller is let through and logged as `would_refuse_role`.
+    Shadow,
+    /// An unidentified or unassigned caller is refused.
+    Enforce,
+}
+
+impl Enforcement {
+    /// Reads `off` (the default), `shadow` or `enforce`; anything else is `Off`.
+    pub fn parse(value: Option<&str>) -> Self {
+        match value.map(|v| v.trim().to_ascii_lowercase()).as_deref() {
+            Some("shadow") => Self::Shadow,
+            Some("enforce") => Self::Enforce,
+            _ => Self::Off,
+        }
+    }
+
+    pub fn from_env() -> Self {
+        static MODE: std::sync::OnceLock<Enforcement> = std::sync::OnceLock::new();
+        *MODE.get_or_init(|| Self::parse(std::env::var("HECKS_ROLE_ENFORCEMENT").ok().as_deref()))
+    }
+
+    /// The caller the kernel is asked to check: an unidentified caller becomes the anonymous role
+    /// unless enforcement is off.
+    pub fn effective<'a>(self, caller: Caller<'a>) -> Caller<'a> {
+        if self != Self::Off && caller.role.is_none() && caller.actor_id.is_none() {
+            return Caller { role: Some(ANONYMOUS_ROLE), actor_id: None };
+        }
+        caller
+    }
+}
+
+/// Whether the kernel refused the command for the caller's role.
+fn refused_for_role(result: &serde_json::Value) -> bool {
+    result.get("refusals").and_then(|r| r.as_array()).is_some_and(|all| {
+        all.iter().any(|r| r.get("kind").and_then(|k| k.as_str()) == Some("Unauthorized"))
+    })
+}
+
 // Distinguishes a module refusal from a kernel failure to run at all.
 #[derive(Debug, PartialEq)]
 enum KernelAnswer {
@@ -80,6 +135,21 @@ pub async fn handle_routed(
     handle(client, wasm_path, verb, routed_invocation(to, facts)?, role, config, invoker).await
 }
 
+/// `handle_routed` for a caller the host can name.
+#[allow(clippy::too_many_arguments)]
+pub async fn handle_routed_as(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    verb: &str,
+    to: serde_json::Value,
+    facts: serde_json::Value,
+    caller: Caller<'_>,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+) -> anyhow::Result<Outcome> {
+    handle_as(client, wasm_path, verb, routed_invocation(to, facts)?, caller, config, invoker).await
+}
+
 // Facts-only counterpart to `handle_routed`.
 #[allow(clippy::too_many_arguments)]
 pub async fn handle_facts(
@@ -94,6 +164,20 @@ pub async fn handle_facts(
     handle(client, wasm_path, verb, facts_invocation(facts)?, role, config, invoker).await
 }
 
+/// `handle_facts` for a caller the host can name.
+#[allow(clippy::too_many_arguments)]
+pub async fn handle_facts_as(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    verb: &str,
+    facts: serde_json::Value,
+    caller: Caller<'_>,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+) -> anyhow::Result<Outcome> {
+    handle_as(client, wasm_path, verb, facts_invocation(facts)?, caller, config, invoker).await
+}
+
 // A Mutex, not a bare Arc<Client>: `handle` needs `Client::transaction`,
 // which takes `&mut Client`. Locking also means concurrent callers on
 // this connection can't interleave statements.
@@ -114,6 +198,57 @@ pub async fn handle(
     config: &LineageConfig,
     invoker: &dyn LambdaInvoker,
 ) -> anyhow::Result<Outcome> {
+    handle_as(client, wasm_path, verb, args, Caller { role, actor_id: None }, config, invoker).await
+}
+
+/// Dispatches for a caller, applying `HECKS_ROLE_ENFORCEMENT`: unidentified callers are refused (or,
+/// in shadow, logged as would-be refusals and let through).
+pub async fn handle_as(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    verb: &str,
+    args: serde_json::Value,
+    caller: Caller<'_>,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+) -> anyhow::Result<Outcome> {
+    handle_with(Enforcement::from_env(), client, wasm_path, verb, args, caller, config, invoker).await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn handle_with(
+    mode: Enforcement,
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    verb: &str,
+    args: serde_json::Value,
+    caller: Caller<'_>,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+) -> anyhow::Result<Outcome> {
+    let checked = mode.effective(caller);
+    let outcome = run(client, wasm_path, verb, args.clone(), checked, config, invoker).await?;
+    if mode == Enforcement::Shadow && !outcome.accepted && refused_for_role(&outcome.result) {
+        crate::log::error("would_refuse_role", serde_json::json!({
+            "verb": verb, "role": checked.role, "actor_id": checked.actor_id,
+            "refusals": outcome.result.get("refusals"),
+        }));
+        return run(client, wasm_path, verb, args, Caller::default(), config, invoker).await;
+    }
+    Ok(outcome)
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn run(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    verb: &str,
+    args: serde_json::Value,
+    caller: Caller<'_>,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+) -> anyhow::Result<Outcome> {
+    let role = caller.role;
     let mut guard = client.lock().await;
     let txn = guard.transaction().await?;
 
@@ -147,10 +282,19 @@ pub async fn handle(
     // carries whatever role it was dispatched with. Built as a mutable
     // step, not inlined into the `json!` literal, so a roleless call
     // still omits the `"role"` key entirely rather than sending null.
+    // A fact the command `needs` is answered here, before the kernel's gates read the arguments and
+    // before the step is journaled, so a replay re-dispatches the recorded answer (ADR 0081).
+    let mut args = args;
+    if let Some(domain_ir) = crate::ir::ir() {
+        crate::needs::fill_needs(domain_ir, verb, &mut args, &crate::needs::ProcessClock);
+    }
     let mut step = serde_json::json!({ "verb": verb, "args": args.clone() });
     if let Some(role) = role {
         step["role"] = serde_json::Value::String(role.to_string());
     }
+    if let Some(actor_id) = caller.actor_id {
+        step["actor_id"] = serde_json::Value::String(actor_id.to_string());
+    }
     // Stamped only on this live step; replayed history already carries
     // its own real timestamp, and re-stamping today's time onto a
     // replay would be wrong, not just redundant.
@@ -179,7 +323,15 @@ pub async fn handle(
         }))
         .collect::<Vec<_>>());
 
-    let input = serde_json::json!({ "seed": seed, "steps": steps, "sagas": sagas_seed }).to_string();
+    let mut input = serde_json::json!({ "seed": seed, "steps": steps, "sagas": sagas_seed });
+    // Lets the kernel answer a reaction's command that needs a fact the same way (ADR 0081).
+    if let Some(domain_ir) = crate::ir::ir() {
+        let table = crate::needs::table(domain_ir);
+        if table.as_object().is_some_and(|t| !t.is_empty()) {
+            input["needs"] = table;
+        }
+    }
+    let input = input.to_string();
     // `wasm_runner::run` is sync, and wasmtime-wasi's sync bridge spins up
     // its own tokio runtime internally — fatal on a thread already
     // driving one. `spawn_blocking` moves it off this async runtime.
@@ -1169,6 +1321,60 @@ pub(crate) mod tests {
         assert_eq!(steps.len(), 1, "only the correctly-authorized registration should be persisted");
     }
 
+    #[test]
+    fn enforcement_reads_off_shadow_and_enforce_and_treats_anything_else_as_off() {
+        assert_eq!(Enforcement::parse(None), Enforcement::Off);
+        assert_eq!(Enforcement::parse(Some("")), Enforcement::Off);
+        assert_eq!(Enforcement::parse(Some("nonsense")), Enforcement::Off);
+        assert_eq!(Enforcement::parse(Some("Shadow")), Enforcement::Shadow);
+        assert_eq!(Enforcement::parse(Some(" enforce ")), Enforcement::Enforce);
+    }
+
+    #[test]
+    fn only_an_unidentified_caller_becomes_anonymous_and_only_when_roles_are_checked() {
+        let nobody = Caller::default();
+        assert_eq!(Enforcement::Off.effective(nobody), nobody);
+        for mode in [Enforcement::Shadow, Enforcement::Enforce] {
+            assert_eq!(mode.effective(nobody).role, Some(ANONYMOUS_ROLE));
+            let stated = Caller { role: Some("Teller"), actor_id: None };
+            assert_eq!(mode.effective(stated), stated, "a stated role is kept");
+            let identified = Caller { role: None, actor_id: Some("u1") };
+            assert_eq!(mode.effective(identified), identified, "an identified caller is kept");
+        }
+    }
+
+    // The unidentified caller is the case the host never refused: no role at all.
+    #[tokio::test]
+    async fn an_unidentified_caller_is_refused_when_enforced_and_let_through_when_off_or_shadowed() {
+        let client = scratch_db("rust_host_dispatch_test_enforce").await;
+        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
+        let config = test_config("Banking", 1);
+        let go = |mode: Enforcement, id: &'static str| {
+            let client = &client;
+            let config = &config;
+            async move {
+                handle_with(mode, client, &wasm_path(), "Banking::Customer.Register", register(id), Caller::default(), config, &lambda_client::NeverInvoker)
+                    .await
+                    .unwrap()
+            }
+        };
+
+        let off = go(Enforcement::Off, "CUST-0021").await;
+        assert!(off.accepted, "off keeps the old behaviour: {:?}", off.result);
+
+        let enforced = go(Enforcement::Enforce, "CUST-0022").await;
+        assert!(!enforced.accepted, "an unidentified caller must be refused: {:?}", enforced.result);
+        assert!(refused_for_role(&enforced.result), "{:?}", enforced.result);
+        let error = enforced.result["refusals"][0]["error"].as_str().unwrap();
+        assert!(error.contains("Branch clerk") && error.contains(ANONYMOUS_ROLE), "{error}");
+
+        let shadowed = go(Enforcement::Shadow, "CUST-0023").await;
+        assert!(shadowed.accepted, "shadow lets the command through: {:?}", shadowed.result);
+
+        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        assert_eq!(steps.len(), 2, "the enforced refusal was not persisted; off and shadow were");
+    }
+
     #[tokio::test]
     async fn a_mid_transaction_failure_rolls_back_any_saga_state_already_written() {
         // Deliberately doesn't provision "Transfer": its mutation fails

data/rust/host/src/main.rs

@@ -13,6 +13,7 @@ mod journal;
 mod lambda_client;
 mod log;
 mod mint;
+mod needs;
 mod payments;
 mod presentation;
 mod presentation_write;