hecks 3.11.0 → 3.13.0

data/rust/host/src/platform_signin/wiring_support.rs

@@ -0,0 +1,319 @@
+//! Shared scaffolding for the wiring tests: settings, a recording log, a fake member directory,
+//! and the known-answer vectors turned into callback requests.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+
+use async_trait::async_trait;
+use serde_json::{json, Value};
+
+use super::config::PlatformSigninConfig;
+use super::handler::{CallbackRequest, Random, SigninHandler, SigninLog};
+use super::jti::JtiStore;
+use super::jwks::parse_jwks;
+use super::session::MemberDirectory;
+use super::settings::SigninSettings;
+use super::test_support::StaticKeys;
+use super::verify::Verifier;
+use crate::auth::Session;
+
+pub const SITE_URL: &str = "https://site.example";
+pub const SECRET: &str = "a-long-session-secret-for-tests";
+pub const ISSUER: &str = "https://issuer.example";
+pub const NONCE_A: &str = "NonceNonceNonce0123456789abcdefghijklmn";
+pub const STATE_A: &str = "StateStateState0123456789abcdefghijklmn";
+pub const NONCE_B: &str = "NonceBNonceBNonceB0123456789abcdefghijk";
+pub const STATE_B: &str = "StateBStateBStateB0123456789abcdefghijk";
+
+/// The environment map a site with `mode` switched on would have.
+pub fn env_map(mode: &str) -> HashMap<String, String> {
+    [
+        ("PLATFORM_SIGNIN", mode),
+        ("PLATFORM_ISSUER_URL", ISSUER),
+        ("PLATFORM_SITE_ID", "site-a"),
+        ("PLATFORM_ENVIRONMENT", "production"),
+        ("SITE_URL", SITE_URL),
+        ("SESSION_SECRET", SECRET),
+        ("HECKS_SERVE_MODE", "1"),
+    ]
+    .into_iter()
+    .map(|(k, v)| (k.to_string(), v.to_string()))
+    .collect()
+}
+
+/// Validated settings for `mode`.
+pub fn settings(mode: &str) -> SigninSettings {
+    SigninSettings::from_env_map(&env_map(mode))
+        .expect("valid")
+        .expect("switched on")
+}
+
+/// A log that keeps every event.
+#[derive(Default)]
+pub struct Recorder(Mutex<Vec<(String, Value)>>);
+
+impl SigninLog for Recorder {
+    fn record(&self, event: &str, fields: Value) {
+        self.0.lock().unwrap().push((event.to_string(), fields));
+    }
+}
+
+impl Recorder {
+    /// Every recorded event as one text, for searching.
+    pub fn text(&self) -> String {
+        self.0
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|(e, f)| format!("{e} {f}"))
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// The names of the recorded events, in order.
+    pub fn events(&self) -> Vec<String> {
+        self.0
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|(e, _)| e.clone())
+            .collect()
+    }
+
+    /// The fields of the first event called `name`.
+    pub fn fields_of(&self, name: &str) -> Option<Value> {
+        self.0
+            .lock()
+            .unwrap()
+            .iter()
+            .find(|(e, _)| e == name)
+            .map(|(_, f)| f.clone())
+    }
+}
+
+/// A person the fake store knows.
+#[derive(Clone)]
+pub struct Person {
+    pub email: String,
+    pub role: Option<String>,
+}
+
+impl Person {
+    /// Builds a person with this email and local role.
+    pub fn new(email: &str, role: Option<&str>) -> Self {
+        Self {
+            email: email.into(),
+            role: role.map(str::to_string),
+        }
+    }
+
+    fn session(&self) -> Session {
+        Session {
+            identity_id: "identity-1".into(),
+            email: self.email.clone(),
+            name: "Person".into(),
+            role: self.role.clone(),
+        }
+    }
+}
+
+/// A member store with scripted answers that remembers what it was asked.
+#[derive(Default)]
+pub struct FakeMembers {
+    /// `(issuer, subject)` -> identity id.
+    pub identities: HashMap<(String, String), String>,
+    /// identity id -> the linked member.
+    pub linked: HashMap<String, Person>,
+    /// What linking by email answers.
+    pub provisions: Option<Person>,
+    pub fail: bool,
+    pub calls: Mutex<Vec<String>>,
+}
+
+impl FakeMembers {
+    /// A store where the vectors' identity resolves to `person`.
+    pub fn resolving(person: Person) -> Self {
+        let mut store = Self::default();
+        store.identities.insert(
+            ("https://idp.example".into(), "idp-subject-0001".into()),
+            "identity-1".into(),
+        );
+        store.linked.insert("identity-1".into(), person);
+        store
+    }
+
+    /// A store where nothing resolves and linking by email yields `person`.
+    pub fn provisioning(person: Person) -> Self {
+        Self {
+            provisions: Some(person),
+            ..Self::default()
+        }
+    }
+
+    /// Lists the calls made so far, in order.
+    pub fn called(&self) -> Vec<String> {
+        self.calls.lock().unwrap().clone()
+    }
+
+    fn note(&self, call: &str) -> anyhow::Result<()> {
+        self.calls.lock().unwrap().push(call.to_string());
+        if self.fail {
+            anyhow::bail!("the store is down");
+        }
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl MemberDirectory for FakeMembers {
+    async fn identity_for(&self, issuer: &str, subject: &str) -> anyhow::Result<Option<String>> {
+        self.note("identity_for")?;
+        Ok(self
+            .identities
+            .get(&(issuer.to_string(), subject.to_string()))
+            .cloned())
+    }
+
+    async fn session_for_identity(&self, identity_id: &str) -> anyhow::Result<Option<Session>> {
+        self.note("session_for_identity")?;
+        Ok(self.linked.get(identity_id).map(Person::session))
+    }
+
+    async fn provision(
+        &self,
+        email: &str,
+        issuer: &str,
+        subject: &str,
+    ) -> anyhow::Result<Option<Session>> {
+        self.note(&format!("provision {email} {issuer} {subject}"))?;
+        Ok(self.provisions.as_ref().map(Person::session))
+    }
+}
+
+/// The known-answer file.
+pub fn vectors() -> Value {
+    let path = concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/tests/fixtures/platform_signin_vectors.json"
+    );
+    serde_json::from_slice(&std::fs::read(path).expect("vectors")).expect("json")
+}
+
+/// A verifier that trusts the vectors' key set and pins its issuer, site and environment.
+pub fn vector_verifier(doc: &Value) -> Verifier<StaticKeys> {
+    let pins = &doc["config"];
+    let text = |name: &str| pins[name].as_str().expect("string").to_string();
+    let config = PlatformSigninConfig::new(
+        &text("iss"),
+        &format!("{}/.well-known/jwks.json", text("iss")),
+        &text("aud"),
+        &text("env"),
+    );
+    let parsed = parse_jwks(&doc["jwks"].to_string()).expect("key set");
+    Verifier::new(config, StaticKeys(parsed.keys), JtiStore::new())
+}
+
+/// Percent-encodes everything outside the unreserved set.
+pub fn encode(text: &str) -> String {
+    text.bytes()
+        .map(|b| {
+            if b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.' | b'~') {
+                (b as char).to_string()
+            } else {
+                format!("%{b:02X}")
+            }
+        })
+        .collect()
+}
+
+/// The callback request a browser would make for one vector step.
+pub fn request_for(step: &Value) -> CallbackRequest {
+    let mut query = Vec::new();
+    if let Some(token) = step["token"].as_str() {
+        query.push(format!("token={}", encode(token)));
+    }
+    if let Some(state) = step["state"].as_str() {
+        query.push(format!("state={}", encode(state)));
+    }
+    let cookie_pairs = match step.get("cookie").filter(|c| !c.is_null()) {
+        None => vec![],
+        Some(cookie) => {
+            let part = |n: &str| cookie.get(n).and_then(Value::as_str);
+            let value = match part("state") {
+                Some(state) => format!("{}.{state}", part("nonce").unwrap_or("")),
+                None => part("nonce").unwrap_or("").to_string(),
+            };
+            vec![format!("__Host-signin={value}")]
+        }
+    };
+    CallbackRequest {
+        raw_query: query.join("&"),
+        cookie_pairs,
+    }
+}
+
+/// A random source that hands out `values` in order.
+pub fn scripted_random(values: &[&str]) -> Random {
+    let queue = Mutex::new(
+        values
+            .iter()
+            .map(|v| v.to_string())
+            .collect::<std::collections::VecDeque<_>>(),
+    );
+    Box::new(move || queue.lock().unwrap().pop_front().expect("a scripted value"))
+}
+
+/// A handler over the vectors' verifier with a fixed clock and a recording log.
+pub fn vector_handler(mode: &str, log: Arc<Recorder>) -> SigninHandler {
+    let doc = vectors();
+    let now = doc["now"].as_i64().expect("now");
+    SigninHandler::new(settings(mode), Arc::new(vector_verifier(&doc)), log)
+        .with_clock(Box::new(move || now))
+}
+
+/// The verified claims of an accepted vector.
+pub fn vector_claims(doc: &Value, name: &str) -> super::verify::VerifiedClaims {
+    use super::verify::{SigninCookie, SigninRequest};
+    let step = single(doc, name);
+    let cookie = SigninCookie {
+        nonce: step["cookie"]["nonce"].as_str().unwrap().to_string(),
+        state: step["cookie"]["state"].as_str().unwrap().to_string(),
+    };
+    let request = SigninRequest {
+        token: step["token"].as_str(),
+        state: step["state"].as_str(),
+        cookie: Some(&cookie),
+    };
+    vector_verifier(doc)
+        .verify(&request, doc["now"].as_i64().unwrap())
+        .expect("an accepted vector")
+}
+
+/// The cookies of a response.
+pub fn cookies_of(response: &Value) -> Vec<String> {
+    response
+        .get("cookies")
+        .and_then(Value::as_array)
+        .map(|a| {
+            a.iter()
+                .filter_map(|c| c.as_str().map(str::to_string))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// The vector with this name.
+pub fn single(doc: &Value, name: &str) -> Value {
+    doc["vectors"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|v| v["name"] == name)
+        .unwrap_or_else(|| panic!("vector {name}"))
+        .clone()
+}
+
+#[allow(dead_code)]
+fn _unused() -> Value {
+    json!({})
+}

data/rust/host/src/web.rs

@@ -1686,17 +1686,29 @@ fn redirect(location: &str) -> Value {
     json!({"statusCode": 302, "headers": {"location": location}, "body": "", "isBase64Encoded": false})
 }
 
-// HttpOnly + SameSite always; Secure only when GOOGLE_REDIRECT_URI is
-// https — a localhost http:// callback can't set a Secure cookie.
+// HttpOnly + SameSite always; Secure unless the host's own address is plain http — a localhost
+// http:// callback can't set a Secure cookie. See `account_cookie_flags` for which address counts.
 fn cookie_flags() -> &'static str {
-    let uri = std::env::var("GOOGLE_REDIRECT_URI").unwrap_or_default();
-    if uri.starts_with("http://") {
-        "; Path=/; HttpOnly; SameSite=Lax"
+    let redirect_uri = std::env::var("GOOGLE_REDIRECT_URI").unwrap_or_default();
+    let site_url = std::env::var("SITE_URL").unwrap_or_default();
+    account_cookie_flags(&redirect_uri, &site_url)
+}
+
+// The flags for the account cookie given the Google redirect URI and the site's public address.
+// A host that sets the redirect URI is judged by it, as ever; a host that has stopped setting it
+// is judged by SITE_URL, and with neither set the cookie is Secure.
+pub(crate) fn account_cookie_flags(redirect_uri: &str, site_url: &str) -> &'static str {
+    let judged_by = if redirect_uri.is_empty() { site_url } else { redirect_uri };
+    if judged_by.starts_with("http://") {
+        COOKIE_FLAGS_PLAIN
     } else {
-        "; Path=/; HttpOnly; Secure; SameSite=Lax"
+        COOKIE_FLAGS_SECURE
     }
 }
 
+pub(crate) const COOKIE_FLAGS_SECURE: &str = "; Path=/; HttpOnly; Secure; SameSite=Lax";
+const COOKIE_FLAGS_PLAIN: &str = "; Path=/; HttpOnly; SameSite=Lax";
+
 fn redirect_with_cookie(location: &str, cookie: &str) -> Value {
     json!({"statusCode": 302, "headers": {"location": location}, "cookies": [cookie], "body": "", "isBase64Encoded": false})
 }
@@ -2985,6 +2997,38 @@ mod tests {
 
 }
 
+#[cfg(test)]
+mod cookie_flag_tests {
+    use super::account_cookie_flags;
+
+    const SECURE: &str = "; Path=/; HttpOnly; Secure; SameSite=Lax";
+    const PLAIN: &str = "; Path=/; HttpOnly; SameSite=Lax";
+
+    #[test]
+    fn a_host_that_sets_the_redirect_uri_is_judged_by_it_as_before() {
+        assert_eq!(account_cookie_flags("https://site.example/auth/google/callback", ""), SECURE);
+        assert_eq!(account_cookie_flags("http://localhost:4567/auth/google/callback", ""), PLAIN);
+        assert_eq!(account_cookie_flags("https://site.example/cb", "http://localhost:4321"), SECURE);
+        assert_eq!(account_cookie_flags("http://localhost:4567/cb", "https://site.example"), PLAIN);
+    }
+
+    #[test]
+    fn a_host_with_no_redirect_uri_and_an_https_site_url_still_sets_secure() {
+        assert_eq!(account_cookie_flags("", "https://site.example"), SECURE);
+        assert_eq!(account_cookie_flags("", "https://site.example/"), SECURE);
+    }
+
+    #[test]
+    fn a_host_with_no_redirect_uri_and_an_http_site_url_does_not_demand_secure() {
+        assert_eq!(account_cookie_flags("", "http://localhost:4321"), PLAIN);
+    }
+
+    #[test]
+    fn a_host_with_neither_setting_stays_secure() {
+        assert_eq!(account_cookie_flags("", ""), SECURE);
+    }
+}
+
 #[cfg(test)]
 #[path = "boundary_fuzz/web.rs"]
 mod boundary_fuzz;

data/rust/parser/src/parse/value_object.rs

@@ -140,7 +140,7 @@ pub fn parse_body(
 fn build_value_object_attribute(
     file: &str,
     args: &super::ArgumentGateResult,
-) -> ParseResult<(ir::Attribute, Option<Vec<String>>, Option<ir::ValueObject>)> {
+) -> ParseResult<(ir::Attribute, Option<Vec<ruby_value::Value>>, Option<ir::ValueObject>)> {
     let (attribute, closed_set) = super::build_attribute(file, 0, "attribute", args)?;
     let one_of = super::named_raw(args, "one_of").map(|raw| {
         let trimmed = raw.trim();
@@ -150,7 +150,7 @@ fn build_value_object_attribute(
             .unwrap_or(trimmed);
         ruby_value::split_items(inner)
             .into_iter()
-            .map(|segment| ruby_value::to_s(&ruby_value::read(segment.trim())))
+            .map(|segment| cell_value(segment.trim()))
             .collect()
     });
     Ok((attribute, one_of, closed_set))
@@ -164,7 +164,7 @@ fn install_inline_closed_set(
     vo_name: &str,
     vo: &mut ir::ValueObject,
     field: &str,
-    values: &[String],
+    values: &[ruby_value::Value],
 ) -> ParseResult<()> {
     if !vo.attributes.is_empty() {
         return Err(Diagnostic::new(
@@ -182,11 +182,11 @@ fn install_inline_closed_set(
     }
 
     vo.closed_set = true;
-    // Unmarked like a bare `member` row (`push_member`): Ruby round-trips these through
-    // `Marks#member`, so `true`/`false` export as JSON booleans, not strings.
+    // Read like a `member` row (`push_member`): a quoted value stays a String and a bare
+    // `true`, `false` or number keeps its type, as Ruby's builder holds them.
     vo.members = values
         .iter()
-        .map(|value| vec![(field.to_string(), unmark_scalar(value))])
+        .map(|value| vec![(field.to_string(), value.clone())])
         .collect();
     Ok(())
 }
@@ -207,15 +207,27 @@ fn push_member(
     let fields = args
         .named
         .iter()
-        .map(|(field, raw)| (field.clone(), unmark_scalar(&ruby_value::to_s(&ruby_value::read(raw)))))
+        .map(|(field, raw)| (field.clone(), cell_value(raw)))
         .collect();
     members.push(fields);
     Ok(())
 }
 
-/// Port of `Marks#unmark_scalar` (lib/hecks/bluebook/assembly/marks.rb).
-/// Ruby stores every member field as text and infers Bool/Integer/Float from its shape, so a
-/// quoted "true" or "1" unmarks to a real `true` or `1`.
+/// Reads one member cell from its source spelling, as `Scalars.unmark` reads a stored one
+/// (lib/hecks/bluebook/assembly/scalars.rb): a quoted cell is a String whatever it spells, and a
+/// bare boolean or number keeps its type. Anything else is read through its text.
+fn cell_value(raw: &str) -> ruby_value::Value {
+    match ruby_value::read(raw) {
+        held @ (ruby_value::Value::Str(_)
+        | ruby_value::Value::Bool(_)
+        | ruby_value::Value::Int(_)
+        | ruby_value::Value::Float(_)) => held,
+        other => unmark_scalar(&ruby_value::to_s(&other)),
+    }
+}
+
+/// The text-shape half of `Scalars.unmark`: for a cell that is neither a quoted String nor a
+/// bare boolean or number, `true`, `false` and number-shaped text read back typed.
 fn unmark_scalar(text: &str) -> ruby_value::Value {
     if text == "true" {
         return ruby_value::Value::Bool(true);

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.11.0
+  version: 3.13.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -97,6 +97,8 @@ files:
 - lib/hecks/adapters/driven/postgres_era.adapter
 - lib/hecks/adapters/driven/prism.adapter
 - lib/hecks/adapters/driven/prism.rb
+- lib/hecks/adapters/driven/script_runner.adapter
+- lib/hecks/adapters/driven/script_runner.rb
 - lib/hecks/adapters/driven/secure_random_identity.adapter
 - lib/hecks/adapters/driven/secure_random_identity.rb
 - lib/hecks/adapters/driven/sql_query_builder.rb
@@ -145,6 +147,7 @@ files:
 - lib/hecks/adapters/driving/mcp_scope/argument_policy.rb
 - lib/hecks/adapters/driving/mcp_scope/env_problems.rb
 - lib/hecks/adapters/driving/mcp_scope/presenter.rb
+- lib/hecks/adapters/driving/newcomer.rb
 - lib/hecks/adapters/driving/ruby.rb
 - lib/hecks/adapters/driving/ruby/aggregate_module.rb
 - lib/hecks/adapters/driving/ruby/chapter.rb
@@ -183,6 +186,7 @@ files:
 - lib/hecks/bluebook/assembly/contracts/sagas.rb
 - lib/hecks/bluebook/assembly/contracts/structure.rb
 - lib/hecks/bluebook/assembly/marks.rb
+- lib/hecks/bluebook/assembly/scalars.rb
 - lib/hecks/bluebook/assembly/specializer.rb
 - lib/hecks/bluebook/attribute.rb
 - lib/hecks/bluebook/behaviour/aggregate.rb
@@ -452,13 +456,21 @@ files:
 - lib/hecks/forms/value_object_shape.rb
 - lib/hecks/fqn.rb
 - lib/hecks/framework.rb
+- lib/hecks/framework/bluebook/change.behaviors
+- lib/hecks/framework/bluebook/change.bluebook
+- lib/hecks/framework/bluebook/change.hecksagon
 - lib/hecks/framework/bluebook/compliance.bluebook
 - lib/hecks/framework/bluebook/console_settings.bluebook
 - lib/hecks/framework/bluebook/framework.hecksagon
 - lib/hecks/framework/bluebook/governance.bluebook
 - lib/hecks/framework/bluebook/identity.bluebook
 - lib/hecks/framework/bluebook/privacy.bluebook
-- lib/hecks/framework/oidc.json
+- lib/hecks/framework/change.oidc.json
+- lib/hecks/framework/compliance.oidc.json
+- lib/hecks/framework/console_settings.oidc.json
+- lib/hecks/framework/governance.oidc.json
+- lib/hecks/framework/identity.oidc.json
+- lib/hecks/framework/privacy.oidc.json
 - lib/hecks/freezer.rb
 - lib/hecks/fuzzing.rb
 - lib/hecks/fuzzing/bounded_exhaustive_expressions.rb
@@ -572,11 +584,12 @@ files:
 - lib/hecks/grammar/evolve/keywords.rb
 - lib/hecks/grammar/evolve/seeds.rb
 - lib/hecks/grammar/expression.bluebook
+- lib/hecks/grammar/expression.oidc.json
 - lib/hecks/grammar/expression_operators.json
 - lib/hecks/grammar/grammar.hecksagon
-- lib/hecks/grammar/oidc.json
 - lib/hecks/grammar/operators.rb
 - lib/hecks/grammar/translation.bluebook
+- lib/hecks/grammar/translation.oidc.json
 - lib/hecks/hecks/adapters/bluebook_report.rb
 - lib/hecks/hecks/adapters/codebase/codemods.rb
 - lib/hecks/hecks/adapters/codebase/conformance.rb
@@ -699,10 +712,12 @@ files:
 - lib/hecks/language/adapter.bluebook
 - lib/hecks/language/bluebook/aggregate.bluebook
 - lib/hecks/language/bluebook/attaches/paging.bluebook
+- lib/hecks/language/bluebook/bluebook.behaviors
 - lib/hecks/language/bluebook/bluebook.bluebook
 - lib/hecks/language/bluebook/bluebook.hecksagon
 - lib/hecks/language/bluebook/command.bluebook
 - lib/hecks/language/bluebook/entity.bluebook
+- lib/hecks/language/bluebook/policy.behaviors
 - lib/hecks/language/bluebook/policy.bluebook
 - lib/hecks/language/bluebook/process_manager.bluebook
 - lib/hecks/language/bluebook/projection.bluebook
@@ -837,14 +852,18 @@ files:
 - lib/hecks/projections/deploy/box/access.rb
 - lib/hecks/projections/deploy/box/caddy.rb
 - lib/hecks/projections/deploy/box/compose.rb
+- lib/hecks/projections/deploy/box/edge.rb
 - lib/hecks/projections/deploy/box/hosting.rb
 - lib/hecks/projections/deploy/box/hosting_parts.rb
 - lib/hecks/projections/deploy/box/hosting_settings.rb
+- lib/hecks/projections/deploy/box/logging.rb
 - lib/hecks/projections/deploy/box/roll_recipe.rb
 - lib/hecks/projections/deploy/box/roll_scripts.rb
 - lib/hecks/projections/deploy/box/settings.rb
+- lib/hecks/projections/deploy/box/settings/cdn.rb
 - lib/hecks/projections/deploy/box/settings/checks.rb
 - lib/hecks/projections/deploy/box/settings/containers.rb
+- lib/hecks/projections/deploy/box/settings/logs.rb
 - lib/hecks/projections/deploy/box/settings/origin.rb
 - lib/hecks/projections/deploy/box/settings/patterns.rb
 - lib/hecks/projections/deploy/box/settings/types.rb
@@ -861,8 +880,12 @@ files:
 - lib/hecks/projections/deploy/box/templates/deploy-usage-services.tmpl
 - lib/hecks/projections/deploy/box/templates/deploy-usage-taskdef.tmpl
 - lib/hecks/projections/deploy/box/templates/ecr-repository.yaml.tmpl
+- lib/hecks/projections/deploy/box/templates/edge.mk.tmpl
+- lib/hecks/projections/deploy/box/templates/edge.yaml.tmpl
 - lib/hecks/projections/deploy/box/templates/fetch-secrets.sh
 - lib/hecks/projections/deploy/box/templates/hosting.mk.tmpl
+- lib/hecks/projections/deploy/box/templates/log-group.yaml.tmpl
+- lib/hecks/projections/deploy/box/templates/log-policy.yaml.tmpl
 - lib/hecks/projections/deploy/box/templates/mode-summary-services.tmpl
 - lib/hecks/projections/deploy/box/templates/mode-summary-taskdef.tmpl
 - lib/hecks/projections/deploy/box/templates/provision-database.sh.tmpl
@@ -1165,7 +1188,10 @@ files:
 - lib/hecks/projections/site/edge/behaviours.rb
 - lib/hecks/projections/site/edge/checks.rb
 - lib/hecks/projections/site/edge/findings.rb
+- lib/hecks/projections/site/edge/function_checks.rb
+- lib/hecks/projections/site/edge/function_code.rb
 - lib/hecks/projections/site/edge/pattern.rb
+- lib/hecks/projections/site/edge/redirect_host.js.tmpl
 - lib/hecks/projections/site/edge/route_checks.rb
 - lib/hecks/projections/site/edge/row_reader.rb
 - lib/hecks/projections/site/edge/rules.rb
@@ -1481,6 +1507,7 @@ files:
 - lib/hecks/rust_build/host.rb
 - lib/hecks/rust_build/kernel_input.rb
 - lib/hecks/rust_build/native_build.rb
+- lib/hecks/rust_build/prebuilt_binary.rb
 - lib/hecks/rust_build/project_rust.rb
 - lib/hecks/rust_build/project_rust/codegen_run.rb
 - lib/hecks/rust_build/project_rust/domain_loader.rb
@@ -1559,6 +1586,7 @@ files:
 - lib/hecks/tools/lanes.rb
 - lib/hecks/tools/lanes/files.rb
 - lib/hecks/tools/lanes/live.rb
+- lib/hecks/tools/lanes/prebuilt_workflow.rb
 - lib/hecks/tools/lanes/rows.rb
 - lib/hecks/tools/lanes/ruleset.rb
 - lib/hecks/tools/lanes/watch_workflow.rb
@@ -1567,6 +1595,7 @@ files:
 - lib/hecks/tools/oidc_manifests.rb
 - lib/hecks/tools/query_ir_run.rb
 - lib/hecks/tools/regeneration_run.rb
+- lib/hecks/tools/release_only.rb
 - lib/hecks/tools/rust_comment_style.rb
 - lib/hecks/tools/rust_comment_style/caps_words.rb
 - lib/hecks/tools/rust_comment_style/fixing.rb
@@ -1607,9 +1636,9 @@ files:
 - lib/rubocop/cop/hecks/symbol_string_key_mix.rb
 - lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb
 - lib/rubocop/cop/hecks/untyped_raise.rb
-- prebuilt/05c358d38d661a3774f813d49c66f5b68939af94432d66257a56f49ee2598994.marshal
-- prebuilt/26c40c61f09b09b11651c64668eda3ceb180f83cf2a3802d3033d2fd99ac841b.marshal
-- prebuilt/verdicts-230ac18c25abfd3d92ede032bee2661a4c2cd2773ab0cf0e2ae52546ba2f7af9.json
+- prebuilt/2b59737fbdbd5f44edda0fddce2611f45d76087b3a7c782d1f1a17ea58c77948.marshal
+- prebuilt/58208399bada10b0db99928c48e38789288fc58f7b71a72b21bfa386680e32ed.marshal
+- prebuilt/verdicts-48318ca172edd21443b1ad02801c697fff100b746e828f09db987647641a5df2.json
 - qa/settings.yml
 - rust/.cargo/config.toml
 - rust/.cargo/mutants.toml
@@ -1706,6 +1735,29 @@ files:
 - rust/host/src/payments.rs
 - rust/host/src/payments/keystore.rs
 - rust/host/src/payments/tests.rs
+- rust/host/src/platform_signin/attack_tests.rs
+- rust/host/src/platform_signin/config.rs
+- rust/host/src/platform_signin/cookie.rs
+- rust/host/src/platform_signin/extension.rs
+- rust/host/src/platform_signin/fetcher.rs
+- rust/host/src/platform_signin/handler.rs
+- rust/host/src/platform_signin/handler_tests.rs
+- rust/host/src/platform_signin/jti.rs
+- rust/host/src/platform_signin/jwks.rs
+- rust/host/src/platform_signin/jws.rs
+- rust/host/src/platform_signin/known_answer_tests.rs
+- rust/host/src/platform_signin/mapping_tests.rs
+- rust/host/src/platform_signin/mod.rs
+- rust/host/src/platform_signin/mode_tests.rs
+- rust/host/src/platform_signin/pages.rs
+- rust/host/src/platform_signin/query.rs
+- rust/host/src/platform_signin/session.rs
+- rust/host/src/platform_signin/settings.rs
+- rust/host/src/platform_signin/strict_json.rs
+- rust/host/src/platform_signin/test_support.rs
+- rust/host/src/platform_signin/ttl_tests.rs
+- rust/host/src/platform_signin/verify.rs
+- rust/host/src/platform_signin/wiring_support.rs
 - rust/host/src/presentation.rs
 - rust/host/src/presentation_write.rs
 - rust/host/src/query_step.rs