hecks 3.11.0 → 3.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 130184b20d584f87b5ede5d45364b213c07677a3330fa198bee6680077ef1899
-  data.tar.gz: f60d730c4d1fc428703bdcc3dcd63f07ea10b77386e0eab4dcab12180e04cac4
+  metadata.gz: beba8cd60d4c859286fa1121e3b382cc63e826e010dfd336714befa036dfad94
+  data.tar.gz: 16deb6ba2dd98c8d09385e77a9773f92ef12726d097e71601d2e3cfdbb83ae00
 SHA512:
-  metadata.gz: 5afb2bcf079a1024b02260e7e428cbb5dbb7661d4df86e093c7813879b0617aae35c63bf25c4fac8025542e5ed05c0cd199eb1046b8ce52555e5ca1717c9662a
-  data.tar.gz: e5cc44483d1cf6eff9c9fcbc0beef4b0c42b70c46ce0a9d50c26b4f4012604dd17200104036833e062bdb3921232c0938d58841c779c7a952bc0562e919b78a3
+  metadata.gz: fe730368d2f8942c67a5510c5b8344bdad86f9aa0990515903e147da4fe71fbc6f17880ea2a1b26de4ffa0d24ad20c416455df58ee8a66617e1f832b2637e2b0
+  data.tar.gz: a41080c78fc7b1e9d43347fd4b965d6811c246baee7072214c5f7895564eccc94ce699b86bc739de0f3d7d7830fb8057e6bf2e0699496e201ffd057c7e6a39d5

data/lib/hecks/adapters/driving/cli_runner/resolution.rb

@@ -82,8 +82,9 @@ module Hecks
           # with the first sentence of what it is for.
           #
           # @return [Hash{Symbol => Object}] `:hide` and `:chapters` (pairs of word and summary)
-          def audience(runtime, launcher, maintainer: LauncherOptions.maintainer?)
-            shown = LauncherOptions.audience(launcher, maintainer)
+          def audience(runtime, launcher, maintainer: LauncherOptions.maintainer?,
+                       newcomer: !maintainer && Newcomer.applies?)
+            shown = (newcomer && Newcomer.audience(launcher)) || LauncherOptions.audience(launcher, maintainer)
             return shown unless shown[:chapters]
 
             shown.merge(chapters: chapter_summaries(runtime, shown[:chapters]))
@@ -102,7 +103,9 @@ module Hecks
 
           # Names who the help is for, so the help remembered for one is not given to the other.
           def audience_key
-            LauncherOptions.maintainer? ? "maintainer" : "project"
+            return "maintainer" if LauncherOptions.maintainer?
+
+            Newcomer.applies? ? "newcomer" : "project"
           end
 
           # Reads the entry words of a line: whether it asks a query, the bare name, and the words

data/lib/hecks/adapters/driving/cli_runner.rb

@@ -3,6 +3,7 @@ require_relative "cli"
 require_relative "command_request"
 require_relative "json"
 require_relative "launcher_options"
+require_relative "newcomer"
 require_relative "../../projector"
 require_relative "../../ports/clock"
 require_relative "cli_runner/answers"

data/lib/hecks/adapters/driving/newcomer.rb

@@ -0,0 +1,50 @@
+require_relative "launcher_options"
+
+module Hecks
+  module Adapters
+    module Driving
+      # The launcher's help for someone starting out: a folder with no bluebook in it has no use yet
+      # for the commands that act on a domain, so the help lists only the `newcomer` commands the
+      # chapter's `launcher` setting names (`hecks --all` lists the rest).
+      module Newcomer
+        # How deep under a directory a bluebook may sit and still make it a project:
+        # `Hecks.bluebook` beside it, or `bluebook/pizzas.bluebook` one folder down, as the
+        # examples keep theirs.
+        PROJECT_GLOBS = ["*.bluebook", "*/*.bluebook", "*/*/*.bluebook"].freeze
+
+        module_function
+
+        # Whether the person is in a folder with no bluebook in it, outside a hecks checkout.
+        #
+        # @param dir [String] where the command line was typed
+        # @param env [#[]] the environment
+        # @return [Boolean] true when no `.bluebook` stands in `dir` or up to two folders below it
+        def applies?(dir = Dir.pwd, env = ENV)
+          return false if LauncherOptions.maintainer?(dir, env)
+
+          PROJECT_GLOBS.none? { |pattern| bluebook_under?(dir, pattern) }
+        end
+
+        # The help options a newcomer gets: only the setting's `newcomer` commands, and no chapters.
+        #
+        # @param settings [Hash, nil] the chapter's `launcher` setting
+        # @return [Hash{Symbol => Object}, nil] `:only` and `:chapters`, or nil when the chapter
+        #   names no newcomer commands
+        def audience(settings)
+          return unless settings && settings[:newcomer]
+
+          { only: Array(settings[:newcomer]).map(&:to_s), chapters: [] }
+        end
+
+        # Whether `pattern` finds a bluebook under `dir`; a folder the person may not read holds
+        # none.
+        # @api private
+        def bluebook_under?(dir, pattern)
+          Dir.glob(File.join(File.expand_path(dir), pattern)).any?
+        rescue SystemCallError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/hecks/bluebook/assembly/contracts/read_models.rb

@@ -61,7 +61,7 @@ module Hecks
         "Member"    => Contract.new(
           holder: nil, make: nil,
           fields: {},
-          rows: { pairs: :pair_rows },
+          rows: { pairs: :member_pair_rows },
           derived: { position: :walk, pairs: [:folded, %i[members], nil] }
         )
       }.freeze

data/lib/hecks/bluebook/assembly/marks.rb

@@ -35,10 +35,10 @@ module Hecks
         # One identity part, as the String path `identity_paths` splits.
         def identity_path(part) = part[:value].to_s
 
-        # A member's fields, an open map, so the pairs arrive as a list.
-        # Values are unmarked because `ValueObject#to_h` spells them with `to_s`.
+        # A member's fields, an open map, so the pairs arrive as a list. Each value is already
+        # typed: `Reconstruction` reads a stored cell with `Scalars.unmark` before it gets here.
         def member(pairs)
-          pairs.to_h { |key, value| [key.to_sym, unmark_scalar(value)] }
+          pairs.to_h { |key, value| [key.to_sym, value] }
         end
 
         # A read model's gathered head; `as` is a Symbol because `ReadModel#to_h` spells it `to_s`.
@@ -49,18 +49,6 @@ module Hecks
         # Matches the builder's native `{field: :symbol}` shape.
         def group_by_field(row) = { field: row[:field].to_sym }
 
-        # Reads a member's scalar back from text. Unlike `read`, a bare word stays a
-        # String, because a closed set admits words far more often than symbols.
-        def unmark_scalar(value)
-          text = value.to_s
-          return true       if text == "true"
-          return false      if text == "false"
-          return text.to_i  if text.match?(/\A-?\d+\z/)
-          return text.to_f  if text.match?(/\A-?\d+\.\d+\z/)
-
-          text
-        end
-
         # A saga's argument bindings; Literal marks a Symbol with a leading colon.
         def bindings(with) = Array(with).to_h { |key, value| [key.to_sym, read(value)] }
 

data/lib/hecks/bluebook/assembly/scalars.rb

@@ -0,0 +1,39 @@
+module Hecks
+  module Bluebook
+    class Assembly
+      # How a `member` cell is spelled as stored text, and read back. The meta-domain holds a cell
+      # as text, so a quoted `"true"` and a bare `true` need different spellings: a boolean or
+      # number is its own spelling, and a String that would read back as one, or as quoted text,
+      # is quoted so it stays a String. The Rust parser reads a cell the same way (`cell_value`
+      # in `parse/value_object.rs`).
+      module Scalars
+        module_function
+
+        # @param value [Object] a cell as the builder holds it
+        # @return [Object] `value` itself unless it is a String that reads back as another type, in
+        #   which case its quoted spelling
+        def mark(value)
+          return value unless value.is_a?(String)
+
+          unmark(value) == value ? value : Literal.quote(value)
+        end
+
+        # Unlike `Literal.read`, a bare word stays a String, because a closed set admits words far
+        # more often than symbols; quoted text is a String whatever it spells.
+        #
+        # @param value [#to_s] a cell's stored text
+        # @return [Object] the String, boolean or number the text spells
+        def unmark(value)
+          text = value.to_s
+          return Literal.unquote(text) if Literal.quoted?(text)
+          return true       if text == "true"
+          return false      if text == "false"
+          return text.to_i  if text.match?(/\A-?\d+\z/)
+          return text.to_f  if text.match?(/\A-?\d+\.\d+\z/)
+
+          text
+        end
+      end
+    end
+  end
+end

data/lib/hecks/bluebook/meta_validator/readings.rb

@@ -70,6 +70,12 @@ module Hecks
           Array(map&.to_h).map { |key, value| { key: key, value: value } }
         end
 
+        # A member's cells, each spelled so a quoted `"true"` stays a String and a bare `true` a
+        # boolean.
+        def member_pair_rows(map)
+          Array(map&.to_h).map { |key, value| { key: key, value: Assembly::Scalars.mark(value) } }
+        end
+
         # Flattens options via `extra_options_to_h` — a new option needs no
         # change here. `filters: true` reads wheres/order_by/limit live off
         # the node, not `to_h`, so wire-format changes there don't affect it.

data/lib/hecks/bluebook/meta_validator/reconstruction.rb

@@ -41,11 +41,14 @@ module Hecks
         # dispatched state, one member at a time, not behind a `DeclaredIn` query.
         def members_row(row) = members_of(row)
 
-        # The key is stringified, never the value: a pair's value keeps whatever
-        # native Ruby type the source line actually wrote.
+        # The key is stringified, never the value: a pair's value is read back from its text by
+        # `Assembly::Scalars`, so a quoted cell returns a String and `true`, `false` and numbers
+        # return as the builder holds them.
         def members_of(value_object_row)
           Array(value_object_row[:members]).map do |member|
-            Array(member[:pairs]).map { |pair| [text(pair[:key]).to_s, text(pair[:value])] }
+            Array(member[:pairs]).map do |pair|
+              [text(pair[:key]).to_s, Assembly::Scalars.unmark(text(pair[:value]))]
+            end
           end
         end
 

data/lib/hecks/bluebook.rb

@@ -35,6 +35,7 @@ require_relative "bluebook/assembly/contract"
 require_relative "bluebook/assembly/contracts"
 require_relative "bluebook/assembly/specializer"
 require_relative "bluebook/assembly/build"
+require_relative "bluebook/assembly/scalars"
 require_relative "bluebook/assembly/marks"
 require_relative "bluebook/assembly/aggregate_assembly"
 require_relative "bluebook/assembly"

data/lib/hecks/deploy/bluebook/deploy.bluebook

@@ -212,6 +212,7 @@ Hecks.bluebook "Deploy" do
     attribute :volume_gb,      VolumeGb
     attribute :database_class, DatabaseClass
     attribute :storage_gb,     StorageGb
+    attribute :cdn_aliases,    list_of(CdnAlias), optional: true
 
     value_object "DomainName" do
       attribute :value, String
@@ -251,8 +252,19 @@ Hecks.bluebook "Deploy" do
       invariant("storage is at most 65536 GB") { value <= 65536 }
     end
 
-    # All six required for the same reason as `FargateTarget.Declare`; this validates a target
-    # already resolved by `hecks deploy project`'s defaults.
+    # A host name the CloudFront edge answers on, such as app.example.com. Lowercase labels only:
+    # CloudFront refuses a name its certificate does not cover at deploy, which this cannot see.
+    value_object "CdnAlias" do
+      attribute :value, String
+      invariant("a CDN alias is a lowercase host name such as app.example.com") do
+        value.to_s.match?(/\A([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]\z/)
+      end
+      invariant("a CDN alias is at most 253 characters") { value.to_s.length <= 253 }
+    end
+
+    # The first six are required for the same reason as `FargateTarget.Declare`; this validates a
+    # target already resolved by `hecks deploy project`'s defaults. `cdn_aliases` is the one
+    # optional setting: naming at least one asks for the CloudFront edge stack.
     command "Declare" do
       goal "Validate one domain's AwsBox deploy target before anything is generated from it"
 
@@ -262,6 +274,7 @@ Hecks.bluebook "Deploy" do
       attribute :volume_gb,      VolumeGb
       attribute :database_class, DatabaseClass
       attribute :storage_gb,     StorageGb
+      attribute :cdn_aliases,    list_of(CdnAlias), optional: true
 
       sets :domain
       sets :region
@@ -269,6 +282,7 @@ Hecks.bluebook "Deploy" do
       sets :volume_gb
       sets :database_class
       sets :storage_gb
+      sets :cdn_aliases
 
       emits "BoxTargetDeclared"
     end

data/lib/hecks/gate/stages.yml

@@ -94,6 +94,38 @@ unguarded_push:
     - *check_comment_blocks
     - *check_fuzzing
 
+# The Rust io specs `ci-rust-io.yml` runs in its `rspec_rust_io` job, for a push that wants their
+# answer first: `hecks gate_run.gate stage=rust_io --wait`. No hook or workflow runs it. It sets CI
+# as the job does, so a skipped example fails here as it fails there. rust/src/generated is not
+# committed, so the check materializes it first, as the job's generated-rust action does. The specs
+# mutate rust/, and a stage's checks run at once, so the job's two legs run one after the other in
+# a single check. spec/gate_rust_io_stage_spec.rb pins the spec lists to the workflow's matrix.
+rust_io:
+  env:
+    CI: "true"
+    HECKS_ENVIRONMENT: memory
+  checks:
+    - id: rust_io
+      title: rust io specs, conformance, coercion, has_many, semantics corpus and feature exclusivity
+      run:
+        - sh
+        - -ec
+        - |
+          # Building the banking crate makes banking the default feature and rewrites the module
+          # list, both tracked. They are put back on the way out, and the check will not start over
+          # a person's uncommitted edits to them.
+          rewritten="rust/Cargo.toml rust/src/generated/mod.rs"
+          if [ -n "$(git status --porcelain -- $rewritten)" ]; then
+            echo "uncommitted changes in $rewritten; commit or discard them first" >&2
+            exit 1
+          fi
+          trap 'git checkout -q -- $rewritten' EXIT
+          env -u CARGO_TARGET_DIR bundle exec exe/hecks regeneration_run.regenerate_corpus --confirm --wait
+          bundle exec exe/hecks build.project_rust domain=examples/banking --wait
+          bundle exec rspec --tag io --profile 8 spec/rust_conformance_spec.rb spec/rust_conformance_fuzz_spec.rb spec/rust_numeric_coercion_spec.rb spec/rust_generated/has_many_spec.rb spec/semantics_corpus_spec.rb
+          bundle exec rspec --tag io --profile 8 spec/rust_generated/domain_feature_exclusivity_spec.rb
+      blocked: a Rust io spec failed, or skipped; the crate it built is under rust/target.
+
 # The checks `.github/workflows/ci-checks.yml` runs. It sets no `env`: the job's journal choice
 # (the `hecks-environment` action) reaches every check, as it reached each command before.
 ci:

data/lib/hecks/hecks/adapters/rehearsal/postgres_store.rb

@@ -119,9 +119,13 @@ module Hecks
           ["pg_restore", "--no-owner", "--no-privileges", "-d", database_name, file]
         end
 
+        # What the URL names, and nothing it leaves out: `postgres:///postgres` parses with an empty
+        # host, which would override a `PGHOST` the environment sets and send the restore to the
+        # local socket while the rest of the rehearsal reached the server by TCP.
         def restore_env
           uri = URI.parse(server_url)
-          { "PGHOST" => uri.host, "PGPORT" => uri.port&.to_s, "PGUSER" => uri.user, "PGPASSWORD" => uri.password }.compact
+          { "PGHOST" => uri.host, "PGPORT" => uri.port&.to_s, "PGUSER" => uri.user, "PGPASSWORD" => uri.password }
+            .reject { |_name, value| value.to_s.empty? }
         end
       end
     end

data/lib/hecks/hecks/hecks.world

@@ -36,6 +36,8 @@
 # checkout runs (Codebase, and releasing hecks itself): the help leaves them out anywhere else and
 # `--maintainer` lists them; `chapters` names the attached chapters the help points at, one line each
 # (`hecks deploy`), and `maintainer_chapters` the language's own, added inside a checkout.
+# `newcomer` names the only commands the help lists in a folder holding no bluebook yet
+# (`hecks --all` lists the rest), so a first run shows how to start and nothing else.
 Hecks.world "Hecks" do
   realm "Hecks"
   default_adapter "PostgresEra"
@@ -58,6 +60,7 @@ Hecks.world "Hecks" do
                        maintainer: %w[LanguageRun KernelRun ConformanceRun RegenerationRun GateRun StyleRun InspectionRun
                                       CodemodRun TestSuiteRun CorpusRun PublishingRun PromotionRun Release
                                       SyntaxBootCache],
+                       newcomer: %w[launch.init launch.interview operation.open_console],
                        chapters: %w[Deploy Governance Tenancy Site Tickets QualityControl],
                        maintainer_chapters: %w[Bluebook Hecksagon World Adapter Port Translation Expression],
                        memory_commands: %w[console init interview],

data/lib/hecks/language/bluebook/bluebook.behaviors

@@ -0,0 +1,23 @@
+Hecks.behaviors "Bluebook" do
+  vision "A chapter is opened with a name, a vision and a classification, and refuses a classification the language does not admit."
+
+  loads "bluebook.bluebook", "bluebook.hecksagon"
+
+  test "Declare opens a chapter" do
+    tests "Declare", on: "Bluebook"
+    input name: "Pizzas", vision: "Pizzas, built and sold.", classification: "core"
+    expect emits: ["ChapterDeclared"]
+  end
+
+  test "Declare refuses a classification that is not core, supporting or generic" do
+    tests "Declare", on: "Bluebook"
+    input name: "Pizzas", vision: "Pizzas, built and sold.", classification: "huge"
+    expect refused: "a chapter is core, supporting, or generic"
+  end
+
+  test "Declare refuses a chapter with no name" do
+    tests "Declare", on: "Bluebook"
+    input name: "", vision: "Pizzas, built and sold.", classification: "core"
+    expect refused: "a chapter is named"
+  end
+end

data/lib/hecks/language/bluebook/policy.behaviors

@@ -0,0 +1,19 @@
+Hecks.behaviors "Bluebook" do
+  vision "A policy hangs off a chapter and names the event it watches; an unnamed policy is refused."
+
+  loads "bluebook.bluebook", "policy.bluebook", "bluebook.hecksagon"
+
+  test "Declare puts a policy on a chapter" do
+    tests "Declare", on: "Policy"
+    setup  "Bluebook::Bluebook.Declare", name: "Pizzas", vision: "Pizzas, built and sold.", classification: "core"
+    input  bluebook: "Pizzas", name: "NotifyKitchen", on_event: "OrderPlaced"
+    expect emits: ["ReactionDeclared"]
+  end
+
+  test "Declare refuses a policy with no name" do
+    tests "Declare", on: "Policy"
+    setup  "Bluebook::Bluebook.Declare", name: "Pizzas", vision: "Pizzas, built and sold.", classification: "core"
+    input  bluebook: "Pizzas", name: "", on_event: "OrderPlaced"
+    expect refused: "a policy is named"
+  end
+end

data/lib/hecks/language/bluebook/vocabulary.bluebook

@@ -611,6 +611,10 @@ Hecks.bluebook "Bluebook" do
     # `mode` is how `pattern` (an extended regex over changed paths) decides:
     # `touches` runs the job when any changed path matches, `skips_unless` runs it
     # when any changed path does NOT match (the pattern is the safe-to-skip list).
+    # `release_only` answers a different question and ignores `pattern`: `touched` is false only
+    # when the change edits nothing but the `ReleaseFile` rows' files and lines and the base it is
+    # measured against has every inheritable `RequiredCheck` green (ADR 0107), so the run may
+    # inherit that certification.
     # `push` is what a push event does: `skip` leaves the gate out of push runs,
     # `before_sha` diffs against the push's `before` commit.
     value_object "CiGate" do
@@ -624,19 +628,44 @@ Hecks.bluebook "Bluebook" do
       member name: "runtime_changed", workflow: "ci.yml", mode: "touches",
              pattern: '^lib/hecks/runtime/', push: "before_sha",
              label: "does this change touch lib/hecks/runtime/**?"
+      member name: "release_only", workflow: "ci.yml", mode: "release_only",
+             pattern: "", push: "before_sha",
+             label: "is this change only a release bump on a certified base?"
       member name: "postgres_io_relevant_changed", workflow: "ci-postgres-io-parallel.yml", mode: "skips_unless",
              pattern: '^(docs/|editors/|release/|deploy/|\.claude/|\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests)/|\.rubocop\.yml$|\.rubocop_todo\.yml$|\.mcp\.json$|\.rspec-local\.example$|README\.md$|CHANGELOG\.md$|CONTRIBUTING\.md$|SECURITY\.md$|LICENSE$|\.gitignore$)',
              push: "skip",
              label: "does this change touch anything rspec_postgres_io_parallel covers?"
     end
 
+    # The files a release bump edits, and the lines of each it may change. A commit whose whole
+    # diff against a certified base falls inside these rows inherits the base's certification
+    # (`CiGate` `release_only`, ADR 0107): its checks report success without their jobs running,
+    # and the `release_consistency` check still runs on it. `path` is the file, exact; `lines` is
+    # an extended regex every added or removed line of that file must match, empty for any line.
+    value_object "ReleaseFile" do
+      attribute :path,  String
+      attribute :lines, String
+
+      member path: "lib/hecks/version.rb", lines: "^\\s*VERSION = \"[0-9]+\\.[0-9]+\\.[0-9]+\"\\.freeze$"
+      member path: "CHANGELOG.md", lines: ""
+      member path: "README.md", lines: "^(\\*\\*Status:\\*\\* )?Current release: `[0-9]+\\.[0-9]+\\.[0-9]+`"
+      member path: "Gemfile.lock", lines: "^    hecks \\([0-9]+\\.[0-9]+\\.[0-9]+\\)$"
+      member path: "rust/host/HECKS_RELEASE", lines: "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+      member path: "packages/hecks-client/package.json", lines: "^\\s*\"version\": \"[0-9]+\\.[0-9]+\\.[0-9]+\",?$"
+      member path: "packages/hecks-client/package-lock.json", lines: "^\\s*\"version\": \"[0-9]+\\.[0-9]+\\.[0-9]+\",?$"
+    end
+
     # The checks a commit must have passed before a `Promotion` moves it onto a guarded lane. Each
     # is the name of a job in .github/workflows that reports to a commit as a check run; a check
     # that a path gate skipped reports `skipped`, which counts as passed. `hecks promote` reads
     # these rows, and hecks project_lanes writes them into the ruleset of any lane that requires
     # them, so the list lives here and nowhere else.
+    #
+    # `runs` is `always` for a check a release bump still runs (it is not inherited from the base);
+    # empty for a check a bump may inherit.
     value_object "RequiredCheck" do
       attribute :name, String
+      attribute :runs, String
 
       member name: "rspec"
       member name: "checks"
@@ -647,6 +676,7 @@ Hecks.bluebook "Bluebook" do
       member name: "rspec_rust_codegen"
       member name: "rspec_rust_host"
       member name: "rspec_fuzzing"
+      member name: "release_consistency", runs: "always"
     end
 
     # The branches a change travels along. `main` takes pushes with no gate; `stable` takes only
@@ -679,6 +709,28 @@ Hecks.bluebook "Bluebook" do
              release_trailer: "Release-Approved-By"
     end
 
+    # A binary hecks builds once per change to its crate and publishes, so a client that needs the
+    # same binary downloads it instead of compiling it (ADR 0110). `hecks regeneration_run.project_lanes`
+    # writes .github/workflows/publish-<name>.yml from each row; `Hecks::RustBuild::PrebuiltBinary`
+    # reads the same rows to name what to download.
+    #
+    # `crate` is the directory under the checkout that is built and keyed: the key is a hash of every
+    # file in it that goes into the build, so the same bytes in the crate are the same release.
+    # `executable` is the Cargo binary and `target` the Rust triple it is built for. `runner` is the
+    # GitHub-hosted image it is built on, pinned (never `-latest`) because a binary links the
+    # runner's glibc and must run on every host that runs that image or a newer one.
+    # The release is tagged `<name>-<key>` and carries `<executable>-<target>` and its `.sha256`.
+    value_object "PrebuiltBinary" do
+      attribute :name,   String
+      attribute :crate,  String
+      attribute :executable, String
+      attribute :target, String
+      attribute :runner, String
+
+      member name: "host", crate: "rust/host", executable: "bootstrap", target: "x86_64-unknown-linux-gnu",
+             runner: "ubuntu-24.04"
+    end
+
     # The dials of the hecks_qa loop: what each is called, the type of value it takes and what it
     # does. qa/settings.yml holds the values, which are edited and reviewed as a diff; this table
     # holds the rest, so the loader (`Hecks::Fuzzing::QaSettings`) checks the file against it and

data/lib/hecks/projection_files/expression_tables.rb

@@ -47,10 +47,15 @@ module Hecks
         declared = algebra.fetch(operator[:symbol]) do
           raise Refused, "#{operator[:symbol]} is admitted but Vocabulary::Comparison declares no algebra for it"
         end
-        row.merge(compares_less_than: declared[:compares_less_than],
-                  compares_equal: declared[:compares_equal], negated: declared[:negated])
+        row.merge(compares_less_than: spelled_true?(declared[:compares_less_than]),
+                  compares_equal:     spelled_true?(declared[:compares_equal]),
+                  negated:            spelled_true?(declared[:negated]))
       end
 
+      # @param cell [Object] a `Comparison` cell, declared as the text `"true"` or `"false"`
+      # @return [Boolean] whether the cell spells true
+      def spelled_true?(cell) = cell.to_s == "true"
+
       # @param dropped [Hash{String => Array<String>}] operator to the guards evaluating through it
       # @return [String] one line for each operator a projection would strand
       def dropped_message(dropped)

data/lib/hecks/projections/deploy/box/compose.rb

@@ -13,11 +13,13 @@ module Hecks
           #   an ECS task definition when the world names one
           def render_compose_sh(plan, region)
             if plan.task_definition
-              template("render-compose-taskdef.sh.tmpl", "STACK" => plan.infra_name, "FAMILY" => plan.task_definition,
-                                                          "PROXY_IMAGE" => plan.proxy_image)
+              template("render-compose-taskdef.sh.tmpl",
+                       { "STACK" => plan.infra_name, "FAMILY" => plan.task_definition, "PROXY_IMAGE" => plan.proxy_image }
+                         .merge(compose_log_values(plan, region, "$s.name")))
             else
-              template("render-compose.sh.tmpl", "STACK" => plan.infra_name, "REGION" => region,
-                                                 "DB_NAME" => plan.database_name, "PROXY_IMAGE" => plan.proxy_image)
+              template("render-compose.sh.tmpl",
+                       { "STACK" => plan.infra_name, "REGION" => region, "DB_NAME" => plan.database_name,
+                         "PROXY_IMAGE" => plan.proxy_image }.merge(compose_log_values(plan, region, ".name")))
             end
           end
 

data/lib/hecks/projections/deploy/box/edge.rb

@@ -0,0 +1,62 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The CloudFront edge of a box deploy, for a world that declares `cdn`: the `edge.yaml`
+        # stack, the `edge.mk` that deploys it, and the two pieces `make stacks` gains so the box
+        # admits the CDN's addresses. Mixed into `Box`, which supplies `template`.
+        module Edge
+          # The AWS-managed prefix list of CloudFront's origin-facing addresses. Its id differs in
+          # every region, so it is looked up by this name rather than written down.
+          PREFIX_LIST_NAME = "com.amazonaws.global.cloudfront.origin-facing".freeze
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @param region [String] the validated region
+          # @return [Hash{String => String}] `edge.yaml` and `edge.mk`, or nothing without a `cdn`
+          def edge_files(plan, region)
+            return {} unless plan.cdn
+
+            { "edge.yaml" => edge_yaml(plan),
+              "edge.mk"   => template("edge.mk.tmpl", "EDGE_STACK" => plan.edge_stack, "REGION" => region) }
+          end
+
+          # @param plan [Settings::Plan] the resolved settings, with a `cdn`
+          # @return [String] the CloudFront stack
+          def edge_yaml(plan)
+            values = { "STACK" => plan.infra_name, "ALIASES" => plan.cdn.aliases.join(","),
+                       "ORIGIN_HEADER" => plan.origin_header, "ORIGIN_SECRET" => plan.origin_secret }
+            template("edge.yaml.tmpl", values)
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @param region [String] the validated region
+          # @return [Hash{String => String}] the Makefile markers `CDN_CHECK` and `CDN_PARAM`:
+          #   empty without a `cdn`, so a world that does not opt in renders the same Makefile
+          def edge_makefile_values(plan, region)
+            return { "CDN_CHECK" => "", "CDN_PARAM" => "" } unless plan.cdn
+
+            { "CDN_CHECK" => prefix_list_check(region), "CDN_PARAM" => "\t\tCdnPrefixListId=#{prefix_list_lookup(region)} \\" }
+          end
+
+          private
+
+          def prefix_list_query(region)
+            "aws ec2 describe-managed-prefix-lists --region #{region} --filters " \
+              "Name=prefix-list-name,Values=#{PREFIX_LIST_NAME} --query \"PrefixLists[0].PrefixListId\" --output text"
+          end
+
+          def prefix_list_lookup(region)
+            "$$(#{prefix_list_query(region)})"
+          end
+
+          # Stops `make stacks` before it changes anything when the prefix list cannot be found,
+          # because a box deployed without it has no inbound rule and the CDN gets a 504.
+          def prefix_list_check(region)
+            "\t@#{prefix_list_query(region)} | grep -q '^pl-' || { echo \"no #{PREFIX_LIST_NAME} " \
+              "prefix list in #{region}: the box would admit no CDN and answer 504\" >&2; exit 1; }"
+          end
+        end
+      end
+    end
+  end
+end