hecks 3.10.0 → 3.11.0

data/lib/hecks/hecks/custodian.bluebook

@@ -1,236 +1,7 @@
 Hecks.bluebook "Hecks" do
-  # Custodian: operating any domain. Each aggregate here is a concern a client runs against
-  # their own domain (ADR 0080, section 2).
-
-  aggregate "Introspection" do
-    description "A look at a booted domain, answered by the runtime without changing anything."
-
-    attribute :domain, DomainPath
-    identified_by :domain
-
-    value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-
-      invariant("a domain is named by its path") { !value.to_s.empty? }
-    end
-
-    value_object "ChapterName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a chapter is named") { !value.to_s.empty? }
-    end
-
-    value_object "AggregateName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("an aggregate is named") { !value.to_s.empty? }
-    end
-
-    # Each query below is answered by the DomainRuntime port's adapter: the domain is booted
-    # in-process and the answer is the exact text the matching bin script printed.
-
-    # An answer that is one document of text, exactly as the tool that produced it wrote it.
-    value_object "Document" do
-      attribute :text, String
-    end
-
-    query "Ir" do
-      description "The IR a domain's boot produces, as JSON: what golden specs pin and an era hashes."
-      attribute :domain,       DomainPath, optional: true
-      attribute :translations, Boolean,    optional: true
-      attribute :meta,         Boolean,    optional: true
-      returns Document
-    end
-
-    query "Shape" do
-      description "The storage shape an era's label is minted from: a bluebook file or a directory of them."
-      attribute :domain, DomainPath
-      returns Document
-    end
-
-    query "Stores" do
-      description "Every aggregate's current records: the head, not the journal."
-      attribute :domain, DomainPath
-      returns Document
-    end
-
-    query "History" do
-      description "Every journal entry a domain's append-only adapters hold: the whole write history."
-      attribute :domain, DomainPath
-      returns Document
-    end
-
-    query "Statements" do
-      description "A chapter's declared facts, as plain English sentences."
-      attribute :domain,  DomainPath
-      attribute :chapter, ChapterName
-      returns Document
-    end
-
-    query "Narrate" do
-      description "A domain read back in English, whole or for one aggregate."
-      attribute :domain,    DomainPath,    optional: true
-      attribute :aggregate, AggregateName, optional: true
-      returns Document
-    end
-
-    query "Docs" do
-      description "A domain's usage document, whole or for one aggregate."
-      attribute :domain,    DomainPath,    optional: true
-      attribute :aggregate, AggregateName, optional: true
-      returns Document
-    end
-
-    # One file a projection would have written, held as its name and its text.
-    value_object "ProjectedFile" do
-      attribute :name, String
-      attribute :text, String
-    end
-
-    query "ProjectDiagrams" do
-      description "A chapter's Mermaid diagrams, as file names mapped to their text; nothing is written."
-      attribute :domain,  DomainPath
-      attribute :chapter, ChapterName
-      returns list_of(ProjectedFile)
-    end
-
-    query "Glossary" do
-      description "A chapter's Ubiquitous Language glossary, as file names mapped to their text; nothing is written."
-      attribute :domain,  DomainPath
-      attribute :chapter, ChapterName
-      returns list_of(ProjectedFile)
-    end
-  end
-
-  # A journaled command whose work happens outside the runtime (ADR 0080, section 11). Every
-  # command below that runs something follows this one shape, so later aggregates copy it:
-  #
-  #   1. A creating command records the request as a record in state "requested" and emits.
-  #   2. A policy on that event triggers an ask on one of the record's ports. The runtime hands
-  #      the port's adapter the whole record, so the adapter does all the IO, and only there.
-  #   3. The adapter answers (a hash named like a command's arguments) or raises (its message
-  #      is the refusal). One policy per outcome re-enters the record with a command that stores it.
-  #
-  # The ports are declared in hecks.hecksagon; each adapter is in adapters/.
-
-  aggregate "ModelCheckRun" do
-    description "One static analysis over domains' models, and what it found: a check's history."
-
-    attribute :run,     RunKey
-    attribute :domains, DomainList,  optional: true
-    attribute :profile, ProfileName, optional: true
-    attribute :strict,  Switch,      optional: true
-    attribute :report,  Report,      optional: true
-    attribute :checked, Checked,     optional: true
-    attribute :refusal, Report,      optional: true
-    identified_by :run
-
-    value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a run is named") { !value.to_s.empty? }
-    end
-
-    value_object "DomainList" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "ProfileName" do
-      attribute :value, String, pattern: '^client$'
-    end
-
-    value_object "Switch" do
-      attribute :value, Boolean
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    # How many domains the report examined, counted from its headers so a reader need not.
-    value_object "Checked" do
-      attribute :value, Integer
-
-      invariant("a count is not negative") { value >= 0 }
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Pass" => "clean",   from: "requested"
-      transition "Flag" => "flagged", from: "requested"
-    end
-
-    command "ModelCheck" do
-      role "Operator"
-      goal "Check domains for dead states and unreachable steps, and keep the verdict"
-
-      attribute :run,     RunKey
-      attribute :domains, DomainList,  optional: true
-      attribute :profile, ProfileName, optional: true
-      attribute :strict,  Switch,      optional: true
-
-      sets :run
-      sets :domains
-      sets :profile
-      sets :strict
-
-      emits ModelCheckRequested
-    end
-
-    command "Pass" do
-      role "System"
-      goal "Record that the analysis left no error"
-
-      reference_to ModelCheckRun
-      attribute :report,  Report
-      attribute :checked, Checked
-
-      sets :report
-      sets :checked
-
-      emits ModelCheckPassed
-    end
-
-    command "Flag" do
-      role "System"
-      goal "Record that the analysis found something, or could not run, and what it said"
-
-      reference_to ModelCheckRun
-      attribute :refusal, Report
-
-      sets :refusal
-
-      emits ModelCheckFlagged
-    end
-
-    # `hecks model_check` answers once the request is recorded, so the verdict is read here.
-    query "Verdict" do
-      description "What one check found: its status, and the report or the reason it could not run."
-      attribute :run, RunKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Flagged" do
-      description "Every check that left a finding or could not run."
-      where(status: "flagged")
-      order_by :run
-    end
-  end
-
-  policy "AnalyseWhenRequested" do
-    on      "ModelCheckRun.ModelCheckRequested"
-    trigger ModelCheckRun::DomainRuntime::Check, with: { run: :run }
-  end
-
-  policy "RecordTheClean" do
-    on      "ModelCheckRun.ModelCheckAnswered"
-    trigger ModelCheckRun::Pass, with: { report: :report, checked: :checked }
-  end
-
-  policy "RecordTheFlag" do
-    on      "ModelCheckRun.ModelCheckRefused"
-    trigger ModelCheckRun::Flag, with: { refusal: :refusal }
-  end
+  # Custodian: operating a domain, in the Operations module (ADR 0096). Each aggregate here is a
+  # concern a client runs against a domain that is running (ADR 0080, section 2); the tooling for
+  # building one is in tooling.bluebook.
 
   aggregate "Operation" do
     description "One thing an operator ran against a domain, and how it ended."
@@ -321,6 +92,7 @@ Hecks.bluebook "Hecks" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "failed"
       transition "Succeed" => "succeeded", from: "requested"
       transition "Fail"    => "failed",    from: "requested"
     end
@@ -615,6 +387,7 @@ Hecks.bluebook "Hecks" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "unreachable"
       transition "Recheck" => "requested",   from: %w[observed drifted unreachable]
       transition "Observe" => "observed",    from: "requested"
       transition "Drift"   => "drifted",     from: "requested"
@@ -835,6 +608,7 @@ policy "RecordTheEra" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "refused"
       transition "Permit"   => "admitted", from: "requested"
       transition "Settle"   => "settled",  from: "admitted"
       transition "Abandon"  => "refused",  from: %w[requested admitted]
@@ -1204,999 +978,4 @@ policy "RecordTheEra" do
     trigger Era::Abandon, with: { refusal: :refusal }
   end
 
-  aggregate "Package" do
-    description "One package of the bluebook registry, vendored into a project and pinned."
-
-    attribute :package, PackageRef
-    attribute :from,    Location, optional: true
-    attribute :root,    Location, optional: true
-    attribute :report,  Report,   optional: true
-    attribute :refusal, Report,   optional: true
-    identified_by :package
-
-    # `name` for the newest release, `name@1.2.0` for one release, `name@9f2c1ab` for a commit.
-    value_object "PackageRef" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*(@[^ \t\n\r]+)?$'
-
-      invariant("a package is named") { !value.to_s.empty? }
-    end
-
-    # A directory: the source repository (`from`), or the project the files land in (`root`).
-    value_object "Location" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    # An answer that is one document of text, exactly as the tool that produced it wrote it.
-    value_object "Document" do
-      attribute :text, String
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Revendor" => "requested", from: %w[vendored refused]
-      transition "Complete" => "vendored",  from: "requested"
-      transition "Abandon"  => "refused",   from: "requested"
-    end
-
-    # `hecks vendor <package[@version]> [from=path] [root=path]`. The record is named by what was
-    # asked for, so a release is one record; vendoring the same spelling again is `hecks revendor`.
-    # `from` defaults to $EMBRYONAUT_BLUEBOOKS_SRC and `root` to the current directory, both read by
-    # the adapter.
-    command "Vendor" do
-      role "Operator"
-      goal "Pin a package of the bluebook registry into this project, at a release or a commit"
-
-      attribute :package, PackageRef
-      attribute :from,    Location, optional: true
-      attribute :root,    Location, optional: true
-
-      sets :package
-      sets :from
-      sets :root
-
-      emits VendorRequested
-    end
-
-    command "Revendor" do
-      role "Operator"
-      goal "Pin a package that was vendored before again, for the newest release or the same one"
-
-      reference_to Package
-      attribute :from, Location, optional: true
-      attribute :root, Location, optional: true
-
-      sets :from
-      sets :root
-
-      emits RevendorRequested
-    end
-
-    command "Complete" do
-      role "System"
-      goal "Record that the package was pinned, and what changed"
-
-      reference_to Package
-      attribute :report, Report
-
-      sets :report
-
-      emits PackageVendored
-    end
-
-    command "Abandon" do
-      role "System"
-      goal "Record that the package could not be pinned, and why"
-
-      reference_to Package
-      attribute :refusal, Report
-
-      sets :refusal
-
-      emits VendoringRefused
-    end
-
-    query "Pinning" do
-      description "What vendoring one package did: its status, and the report or the refusal."
-      attribute :package, PackageRef
-      where(package: :package)
-      order_by :package
-    end
-
-    query "Unpinned" do
-      description "Every package the last vendoring of which was refused."
-      where(status: "refused")
-      order_by :package
-    end
-
-    # `hecks package.verify [root=path]`: a read of the files, so it keeps no record. The manifest
-    # is the answer; a package that disagrees with its lock refuses it, naming each one.
-    query "Verify" do
-      description "Check every vendored package against its bluebook.lock, then describe them as the manifest a client image carries."
-      attribute :root, Location, optional: true
-      returns Document
-    end
-  end
-
-  policy "PinWhenVendored" do
-    on      "Package.VendorRequested"
-    trigger Package::Git::Pin, with: { package: :package }
-  end
-
-  policy "PinWhenRevendored" do
-    on      "Package.RevendorRequested"
-    trigger Package::Git::Pin, with: { package: :package }
-  end
-
-  policy "RecordThePinning" do
-    on      "Package.PackagePinned"
-    trigger Package::Complete, with: { report: :report }
-  end
-
-  policy "RecordTheRefusedPin" do
-    on      "Package.PinRefused"
-    trigger Package::Abandon, with: { refusal: :refusal }
-  end
-
-  aggregate "Registry" do
-    description "A bluebook registry repository: packages versioned in it and released as tags."
-
-    attribute :run,     RegistryKey
-    attribute :package, PackageName, optional: true
-    attribute :root,    Location,    optional: true
-    attribute :report,  Report,      optional: true
-    attribute :refusal, Report,      optional: true
-    identified_by :run
-
-    value_object "RegistryKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a release is named") { !value.to_s.empty? }
-    end
-
-    value_object "PackageName" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
-    end
-
-    # The registry repository: the current directory when absent.
-    value_object "Location" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    # An answer that is one document of text, exactly as the tool that produced it wrote it.
-    value_object "Document" do
-      attribute :text, String
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Complete" => "tagged",  from: "requested"
-      transition "Abandon"  => "refused", from: "requested"
-    end
-
-    # `hecks package.release <package> [root=path]`. Tags the package's current version as
-    # `<package>-vX.Y.Z` in the local repository and never pushes; the report ends in the command
-    # that does. A refusal says which rule the package broke.
-    command "Release" do
-      role "Operator"
-      goal "Tag a package of this registry at the version its bluebook.yml carries"
-
-      attribute :run,     RegistryKey
-      attribute :package, PackageName
-      attribute :root,    Location, optional: true
-
-      sets :run
-      sets :package
-      sets :root
-
-      emits ReleaseRequested
-    end
-
-    command "Complete" do
-      role "System"
-      goal "Record that the release was tagged, and the command that publishes it"
-
-      reference_to Registry
-      attribute :report, Report
-
-      sets :report
-
-      emits ReleaseRecorded
-    end
-
-    command "Abandon" do
-      role "System"
-      goal "Record that the release was refused, and why"
-
-      reference_to Registry
-      attribute :refusal, Report
-
-      sets :refusal
-
-      emits ReleaseAbandoned
-    end
-
-    # `hecks package.check [root=path]`: a read of the repository's files and tags, so it keeps no
-    # record. A package that changed since its latest release without a version bump and a changelog
-    # entry refuses it, naming each one.
-    query "Check" do
-      description "Judge every package against its latest release: a changed package needs a newer version and a changelog entry."
-      attribute :root, Location, optional: true
-      returns Document
-    end
-
-    # `hecks package.digest <package> [root=path]`: a read of the package's files, so it keeps no
-    # record. The digest is `Lock.digest_of` over `<package>/bluebook/*.bluebook` only (the
-    # `bluebook.lock` digest line), then the package's shape labels; `root` is the registry, or a
-    # project that vendors the package.
-    query "Digest" do
-      description "Print a package's content digest and shape labels, as its bluebook.lock records them."
-      attribute :package, PackageName
-      attribute :root, Location, optional: true
-      returns Document
-    end
-
-    query "Releasing" do
-      description "What releasing one run did: its status, and the report or the refusal."
-      attribute :run, RegistryKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Refused" do
-      description "Every release that was refused."
-      where(status: "refused")
-      order_by :run
-    end
-  end
-
-  policy "TagWhenReleased" do
-    on      "Registry.ReleaseRequested"
-    trigger Registry::Git::Tag, with: { run: :run }
-  end
-
-  policy "RecordTheTag" do
-    on      "Registry.ReleaseTagged"
-    trigger Registry::Complete, with: { report: :report }
-  end
-
-  policy "RecordTheRefusedTag" do
-    on      "Registry.ReleaseRefused"
-    trigger Registry::Abandon, with: { refusal: :refusal }
-  end
-
-  # A run record for opening a door onto the framework, not a door: the doors live in `Hecks::Doors`.
-  aggregate "Door" do
-    description "A way into the framework opened for a project: its launchers, or an MCP server."
-
-    attribute :run,     DoorKey
-    attribute :domains, DomainList, optional: true
-    attribute :stdio,   Switch,     optional: true
-    attribute :name,    DomainName, optional: true
-    attribute :adapter, AdapterName, optional: true
-    attribute :dir,     TargetDir,  optional: true
-    attribute :expert,  ExpertName, optional: true
-    attribute :no_ai,   Switch,     optional: true
-    attribute :output,  Note,       optional: true
-    attribute :refusal, Note,       optional: true
-    identified_by :run
-
-    value_object "DoorKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a door is named") { !value.to_s.empty? }
-    end
-
-    # Domain directories under the project, comma separated.
-    value_object "DomainList" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Switch" do
-      attribute :value, Boolean
-    end
-
-    # What a new domain is called, as its bluebook spells it: a capital and then letters and digits.
-    value_object "DomainName" do
-      attribute :value, String, pattern: '[A-Z][A-Za-z0-9]*'
-    end
-
-    # A persistence adapter a stub can be bound to; `Hecks::CLI::DomainStub` names the ones it knows.
-    value_object "AdapterName" do
-      attribute :value, String, pattern: '[A-Za-z]+'
-    end
-
-    # Where the new domain goes; the domain's snake-cased name under the current directory when absent.
-    value_object "TargetDir" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    # Who is interviewed; asked for at the terminal when absent.
-    value_object "ExpertName" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Note" do
-      attribute :value, String
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Finish" => "finished", from: "requested"
-      transition "Stop"   => "stopped",  from: "requested"
-    end
-
-    # Writes a launcher beside each domain. It replaces the generated launcher already there and
-    # deletes nothing, so it runs without `confirm` (`hecks project_cli` never asked for one).
-    command "ProjectCli" do
-      role "Operator"
-      goal "Write a command-line launcher beside each domain of this project"
-
-      attribute :run,     DoorKey
-      attribute :domains, DomainList, optional: true
-
-      sets :run
-      sets :domains
-
-      emits LaunchersRequested
-    end
-
-    # Writes the stub files of a new domain (ADR 0087). It asks nothing and replaces nothing: a
-    # directory that already holds any file it would write is refused, with that file named.
-    command "Init" do
-      role "Operator"
-      goal "Write the stub files of a new domain"
-
-      attribute :run,     DoorKey
-      attribute :name,    DomainName
-      attribute :adapter, AdapterName, optional: true
-      attribute :dir,     TargetDir,   optional: true
-
-      sets :run
-      sets :name
-      sets :adapter
-      sets :dir
-
-      emits StubRequested
-    end
-
-    # Holds an interview with a subject matter expert and drafts a first domain from it (ADR 0088).
-    # The Terminal adapter runs the conversation, as it runs a console; the journal records that one
-    # was held and how it ended, not what was said. `--no-ai` leaves the model out.
-    command "Interview" do
-      role "Operator"
-      goal "Hold an interview with a subject matter expert and draft a first domain from it"
-
-      attribute :run,     DoorKey
-      attribute :name,    DomainName
-      attribute :adapter, AdapterName, optional: true
-      attribute :dir,     TargetDir,   optional: true
-      attribute :expert,  ExpertName,  optional: true
-      attribute :no_ai,   Switch,      optional: true
-
-      sets :run
-      sets :name
-      sets :adapter
-      sets :dir
-      sets :expert
-      sets :no_ai
-
-      emits InterviewRequested
-    end
-
-    # A stdio server runs until its client closes stdin, so it cannot be asked and answered
-    # quickly like the others. The command records that the door was started; the Terminal
-    # adapter hands the process over to the door and answers when it closes, as OpenConsole
-    # does for a console. The launcher spells it `serve_mcp`; the `mcp` spelling exe/hecks ships
-    # today stays with its router until the launcher is generated.
-    command "ServeMcp" do
-      role "Operator"
-      goal "Serve the storehouse bus to an MCP client over stdio until it closes"
-
-      attribute :run,   DoorKey
-      attribute :stdio, Switch, optional: true
-
-      sets :run
-      sets :stdio
-
-      emits McpRequested
-    end
-
-    command "Finish" do
-      role "System"
-      goal "Record that the door did its work, or was closed, and what it said"
-
-      reference_to Door
-      attribute :output, Note
-
-      sets :output
-
-      emits DoorFinished
-    end
-
-    command "Stop" do
-      role "System"
-      goal "Record that the door could not be opened, and why"
-
-      reference_to Door
-      attribute :refusal, Note
-
-      sets :refusal
-
-      emits DoorStopped
-    end
-
-    query "Ended" do
-      description "How one door ended: its status, and what it said or why it stopped."
-      attribute :run, DoorKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Stopped" do
-      description "Every door that could not be opened."
-      where(status: "stopped")
-      order_by :run
-    end
-  end
-
-  policy "WriteWhenRequested" do
-    on      "Door.LaunchersRequested"
-    trigger Door::Workspace::Write, with: { run: :run }
-  end
-
-  policy "ScaffoldWhenRequested" do
-    on      "Door.StubRequested"
-    trigger Door::Workspace::Scaffold, with: { run: :run }
-  end
-
-  policy "ConverseWhenRequested" do
-    on      "Door.InterviewRequested"
-    trigger Door::Terminal::Converse, with: { run: :run }
-  end
-
-  policy "ServeWhenRequested" do
-    on      "Door.McpRequested"
-    trigger Door::Terminal::Serve, with: { run: :run }
-  end
-
-  policy "RecordTheDoor" do
-    on      "Door.DoorAnswered"
-    trigger Door::Finish, with: { output: :output }
-  end
-
-  policy "RecordTheStoppedDoor" do
-    on      "Door.DoorRefused"
-    trigger Door::Stop, with: { refusal: :refusal }
-  end
-
-  aggregate "Build" do
-    description "One build of a domain for the Rust host, or a check of that build against Ruby."
-
-    attribute :run,      BuildKey
-    attribute :domain,   DomainPath, optional: true
-    attribute :script,   ScriptPath, optional: true
-    attribute :artifact, Artifact,   optional: true
-    attribute :target,   TargetTriple, optional: true
-    attribute :stage_dir, StagePath, optional: true
-    attribute :seeds,    Count,      optional: true
-    attribute :steps,    Count,      optional: true
-    attribute :output,   Report,     optional: true
-    attribute :refusal,  Report,     optional: true
-    identified_by :run
-
-    value_object "BuildKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a build is named") { !value.to_s.empty? }
-    end
-
-    # A domain directory. Its last part is also a Rust module and a Cargo feature, so it is a
-    # lowercase identifier; the toolchain refuses the reserved words the pattern cannot.
-    value_object "DomainPath" do
-      attribute :value, String, pattern: '(^|/)[a-z][a-z0-9_]*/?$'
-    end
-
-    # A generated module: the directory name a domain was built as.
-    value_object "ModuleName" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
-    end
-
-    # A JSON file of steps for a domain to replay.
-    value_object "ScriptPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    # What a build is replayed through: `native`, `build` (the domain's own feature), a `.wasm`
-    # module, or a binary.
-    value_object "Artifact" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-    end
-
-    # A Rust target triple: `<arch>-<vendor>-<os>` with an optional `-<env>`. The toolchain
-    # refuses the triples a host cannot be built for (a wasm target) and the ones not installed.
-    value_object "TargetTriple" do
-      attribute :value, String, pattern: '^[a-z0-9_]+(-[a-z0-9_.]+){2,3}$'
-    end
-
-    # The directory a host build stages its files in.
-    value_object "StagePath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Count" do
-      attribute :value, Integer
-
-      invariant("a count is positive") { value > 0 }
-    end
-
-    value_object "CodegenName" do
-      attribute :value, String, pattern: '^(ruby|rust)$'
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Complete" => "completed", from: "requested"
-      transition "Fault"    => "faulted",   from: "requested"
-    end
-
-    # Writes the domain's Rust source and a Cargo feature for it into the build workspace: the
-    # checkout's own `rust/`, or a copy of the packaged workspace under `.hecks/rust/<version>/`.
-    # Nothing is ever written into the installed gem.
-    command "ProjectRust" do
-      role "Operator"
-      goal "Generate a domain's Rust source for the Rust host"
-
-      attribute :domain, DomainPath
-      attribute :run,    BuildKey
-
-      sets :domain
-      sets :run
-
-      emits RustProjectionRequested
-    end
-
-    command "BuildWasm" do
-      role "Operator"
-      goal "Compile a domain to a WASI module a runtime such as wasmtime can run"
-
-      attribute :domain, DomainPath
-      attribute :run,    BuildKey
-
-      sets :domain
-      sets :run
-
-      emits WasmBuildRequested
-    end
-
-    # Compiles the host binary from the installed gem's workspace for the target and stages it with
-    # the domain's `.wasm` and `.ir.json` (in `.hecks/host/<target>/` unless `stage_dir` names a
-    # directory), the files a container image copies in.
-    command "BuildHost" do
-      role "Operator"
-      goal "Build the Rust host for a domain, with its wasm and IR, ready to copy into an image"
-
-      attribute :domain, DomainPath
-      attribute :run,    BuildKey
-      attribute :target, TargetTriple, optional: true
-      attribute :stage_dir, StagePath, optional: true
-
-      sets :domain
-      sets :run
-      sets :target
-      sets :stage_dir
-
-      emits HostBuildRequested
-    end
-
-    command "BuildBrowserWasm" do
-      role "Operator"
-      goal "Compile a domain to an ES module a browser can import"
-
-      attribute :domain, DomainPath
-      attribute :run,    BuildKey
-
-      sets :domain
-      sets :run
-
-      emits BrowserWasmBuildRequested
-    end
-
-    # Without an artifact it answers Ruby's own result, which saved to a file becomes a pinned
-    # expectation; with one it compares Ruby's result with that artifact's.
-    command "CheckConformance" do
-      role "Operator"
-      goal "Replay a script through Ruby and a Rust build of the domain and compare what each did"
-
-      attribute :domain,   DomainPath
-      attribute :script,   ScriptPath
-      attribute :run,      BuildKey
-      attribute :artifact, Artifact, optional: true
-
-      sets :domain
-      sets :script
-      sets :run
-      sets :artifact
-
-      emits ConformanceRequested
-    end
-
-    command "FuzzConformance" do
-      role "Operator"
-      goal "Replay generated sequences through Ruby and a Rust build of the domain and compare them"
-
-      attribute :domain,   DomainPath
-      attribute :artifact, Artifact
-      attribute :run,      BuildKey
-      attribute :seeds,    Count, optional: true
-      attribute :steps,    Count, optional: true
-
-      sets :domain
-      sets :artifact
-      sets :run
-      sets :seeds
-      sets :steps
-
-      emits ConformanceFuzzRequested
-    end
-
-    command "CheckCoverageAllowlist" do
-      role "Operator"
-      goal "Check that every rule excusing a Rust coverage gap still excuses a real one"
-
-      attribute :run, BuildKey
-
-      sets :run
-
-      emits CoverageAllowlistRequested
-    end
-
-    command "Complete" do
-      role "System"
-      goal "Record that the build or check ended well, and what it reported"
-
-      reference_to Build
-      attribute :output, Report
-
-      sets :output
-
-      emits BuildCompleted
-    end
-
-    command "Fault" do
-      role "System"
-      goal "Record that the build or check was refused or found a difference, and what it said"
-
-      reference_to Build
-      attribute :refusal, Report
-
-      sets :refusal
-
-      emits BuildFaulted
-    end
-
-    query "Result" do
-      description "How one build or check ended: its status, and what it reported or why it failed."
-      attribute :run, BuildKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Faulted" do
-      description "Every build or check that was refused or found a difference."
-      where(status: "faulted")
-      order_by :run
-    end
-
-    # An answer that is one document of text, exactly as the tool that produced it wrote it.
-    value_object "Document" do
-      attribute :text, String
-    end
-
-    query "RustCoverage" do
-      description "Whether each construct of a generated module has a routed Rust implementation."
-      attribute :module_name, ModuleName
-      attribute :codegen,     CodegenName, optional: true
-      returns Document
-    end
-  end
-
-  policy "GenerateWhenRequested" do
-    on      "Build.RustProjectionRequested"
-    trigger Build::RustToolchain::Generate, with: { run: :run }
-  end
-
-  policy "CompileWasmWhenRequested" do
-    on      "Build.WasmBuildRequested"
-    trigger Build::RustToolchain::Wasm, with: { run: :run }
-  end
-
-  policy "BuildHostWhenRequested" do
-    on      "Build.HostBuildRequested"
-    trigger Build::RustToolchain::Host, with: { run: :run }
-  end
-
-  policy "CompileBrowserWasmWhenRequested" do
-    on      "Build.BrowserWasmBuildRequested"
-    trigger Build::RustToolchain::BrowserWasm, with: { run: :run }
-  end
-
-  policy "ConformWhenRequested" do
-    on      "Build.ConformanceRequested"
-    trigger Build::RustToolchain::Conform, with: { run: :run }
-  end
-
-  policy "ReplayWhenRequested" do
-    on      "Build.ConformanceFuzzRequested"
-    trigger Build::RustToolchain::Replay, with: { run: :run }
-  end
-
-  policy "AuditWhenRequested" do
-    on      "Build.CoverageAllowlistRequested"
-    trigger Build::RustToolchain::Audit, with: { run: :run }
-  end
-
-  policy "RecordTheBuild" do
-    on      "Build.BuildAnswered"
-    trigger Build::Complete, with: { output: :output }
-  end
-
-  policy "RecordTheFault" do
-    on      "Build.BuildRefused"
-    trigger Build::Fault, with: { refusal: :refusal }
-  end
-
-  # Named for the run, as ModelCheckRun is: `Hecks::Fuzzing` is the fuzzing toolkit's own module,
-  # so a hecksagon could not spell an aggregate of that name.
-  aggregate "FuzzRun" do
-    description "One fuzz sweep or benchmark, and how it ended; and the generated sequences it replays."
-
-    attribute :domain,     DomainPath,  optional: true
-    attribute :run,        FuzzKey
-    attribute :seeds,      Count,       optional: true
-    attribute :steps,      Count,       optional: true
-    attribute :workers,    Count,       optional: true
-    attribute :budget,     Count,       optional: true
-    attribute :adapter,    Persistence, optional: true
-    attribute :persist_regressions, RegressionSwitch, optional: true
-    attribute :domains,    NameList,    optional: true
-    attribute :targets,    NameList,    optional: true
-    attribute :iterations, Count,       optional: true
-    attribute :warmup,     Warmup,      optional: true
-    attribute :runs,       Count,       optional: true
-    attribute :rust_binary, BinaryPath, optional: true
-    attribute :format,     Format,      optional: true
-    attribute :output,     OutputPath,  optional: true
-    attribute :report,     Report,      optional: true
-    attribute :refusal,    Report,      optional: true
-    identified_by :run
-
-    value_object "FuzzKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
-
-      invariant("a sweep is named") { !value.to_s.empty? }
-    end
-
-    # A domain directory; a sweep with none covers every domain of a hecks checkout.
-    value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-
-      invariant("a domain is named by its path") { !value.to_s.empty? }
-    end
-
-    value_object "Count" do
-      attribute :value, Integer
-
-      invariant("a count is positive") { value > 0 }
-    end
-
-    value_object "Warmup" do
-      attribute :value, Integer
-
-      invariant("a warmup is not negative") { value >= 0 }
-    end
-
-    # Which persistence every ephemeral boot of a sweep uses.
-    value_object "Persistence" do
-      attribute :value, String, pattern: '^(memory|sqlite|postgres)$'
-    end
-
-    # Whether each distinct finding's minimized repro is also kept under `spec/corpus/regressions/`.
-    value_object "RegressionSwitch" do
-      attribute :value, Boolean
-    end
-
-    # Names, comma separated: benchmark domains, or the targets to measure.
-    value_object "NameList" do
-      attribute :value, String, pattern: '^[^ \t\n\r,]+(,[^ \t\n\r,]+)*$'
-    end
-
-    value_object "BinaryPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Format" do
-      attribute :value, String, pattern: '^(markdown|json)$'
-    end
-
-    value_object "OutputPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    lifecycle :status, default: "requested" do
-      transition "Conclude" => "concluded", from: "requested"
-      transition "Halt"     => "halted",    from: "requested"
-    end
-
-    # A sweep replays generated command and query sequences and checks properties over each.
-    # A finding is shrunk and saved under `tmp/fuzz-failures/`, and ends the run as halted, with
-    # what was found. Sweeping every domain of a checkout needs a hecks checkout; a client names
-    # the domain. The sweep runs in child processes started through the ProcessPool adapter, so an
-    # interrupt reaches the workers.
-    command "Fuzz" do
-      role "Operator"
-      goal "Fuzz a domain with generated sequences and keep whether anything broke a property"
-
-      attribute :domain,  DomainPath,  optional: true
-      attribute :run,     FuzzKey
-      attribute :seeds,   Count,       optional: true
-      attribute :steps,   Count,       optional: true
-      attribute :workers, Count,       optional: true
-      attribute :adapter, Persistence, optional: true
-      attribute :persist_regressions, RegressionSwitch, optional: true
-
-      sets :domain
-      sets :run
-      sets :seeds
-      sets :steps
-      sets :workers
-      sets :adapter
-      sets :persist_regressions
-
-      emits FuzzRequested
-    end
-
-    # Mutation-tests a domain's own checks: changes its bluebooks in small ways and keeps which
-    # changes the fuzz properties, the corpus script and the domain's behaviors tests let through.
-    # A survivor is a hole in those checks. `budget` caps how many mutants are tried. The run is a
-    # child process started through the ProcessPool adapter, as a sweep is.
-    command "Mutate" do
-      role "Operator"
-      goal "Mutate a domain's rules and keep whether its checks noticed each change"
-
-      attribute :domain, DomainPath
-      attribute :run,    FuzzKey
-      attribute :seeds,  Count, optional: true
-      attribute :steps,  Count, optional: true
-      attribute :budget, Count, optional: true
-
-      sets :domain
-      sets :run
-      sets :seeds
-      sets :steps
-      sets :budget
-
-      emits MutateRequested
-    end
-
-    # Measures each persistence adapter, and the Rust binary when there is one to build or use.
-    # The report is kept in this record, which the Hecks domain binds to Memory: keeping a
-    # domain's benchmark history beside it, in Sqlite under the project's `.hecks/`, is decided
-    # with the persistence binding for Custodian, not here. `output` also writes the full JSON.
-    command "Bench" do
-      role "Operator"
-      goal "Measure command throughput and latency for each target, and keep the report"
-
-      attribute :run,         FuzzKey
-      attribute :domains,     NameList,   optional: true
-      attribute :targets,     NameList,   optional: true
-      attribute :iterations,  Count,      optional: true
-      attribute :warmup,      Warmup,     optional: true
-      attribute :runs,        Count,      optional: true
-      attribute :rust_binary, BinaryPath, optional: true
-      attribute :format,      Format,     optional: true
-      attribute :output,      OutputPath, optional: true
-
-      sets :run
-      sets :domains
-      sets :targets
-      sets :iterations
-      sets :warmup
-      sets :runs
-      sets :rust_binary
-      sets :format
-      sets :output
-
-      emits BenchRequested
-    end
-
-    command "Conclude" do
-      role "System"
-      goal "Record that the sweep or benchmark ended well, and what it reported"
-
-      reference_to FuzzRun
-      attribute :report, Report
-
-      sets :report
-
-      emits FuzzConcluded
-    end
-
-    command "Halt" do
-      role "System"
-      goal "Record that the sweep found something or the benchmark could not run, and what it said"
-
-      reference_to FuzzRun
-      attribute :refusal, Report
-
-      sets :refusal
-
-      emits FuzzHalted
-    end
-
-    query "Conclusion" do
-      description "How one sweep or benchmark ended: its status, and what it reported or found."
-      attribute :run, FuzzKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Halted" do
-      description "Every sweep that found something and every benchmark that could not run."
-      where(status: "halted")
-      order_by :run
-    end
-
-    # An answer that is one document of text, exactly as the tool that produced it wrote it.
-    value_object "Document" do
-      attribute :text, String
-    end
-
-    # The generator `hecks fuzz` draws from, on its own: one valid dispatch sequence as a
-    # replayable script. `adversarial` is the fraction of steps mutated to be refused; 0 is off.
-    query "GenerateSequence" do
-      description "One generated, valid dispatch sequence for a domain, as a script `hecks run` replays."
-      attribute :domain,      DomainPath
-      attribute :seed,        Integer,    optional: true
-      attribute :steps,       Integer,    optional: true
-      attribute :adversarial, Float,      optional: true
-      returns Document
-    end
-  end
-
-  policy "SweepWhenRequested" do
-    on      "FuzzRun.FuzzRequested"
-    trigger FuzzRun::ProcessPool::Sweep, with: { run: :run }
-  end
-
-  policy "MutateWhenRequested" do
-    on      "FuzzRun.MutateRequested"
-    trigger FuzzRun::ProcessPool::Probe, with: { run: :run }
-  end
-
-  policy "MeasureWhenRequested" do
-    on      "FuzzRun.BenchRequested"
-    trigger FuzzRun::RustToolchain::Measure, with: { run: :run }
-  end
-
-  policy "RecordTheSweep" do
-    on      "FuzzRun.FuzzAnswered"
-    trigger FuzzRun::Conclude, with: { report: :report }
-  end
-
-  policy "RecordTheFinding" do
-    on      "FuzzRun.FuzzRefused"
-    trigger FuzzRun::Halt, with: { refusal: :refusal }
-  end
 end