hecks 3.12.0 → 3.14.0

data/lib/hecks/framework/privacy.oidc.json

@@ -0,0 +1,30 @@
+{
+  "audience": "Privacy",
+  "scopes": [
+    {
+      "scope": "privacy:marking.mark",
+      "verb": "Privacy::Marking.Mark",
+      "role": "Deployment"
+    },
+    {
+      "scope": "privacy:marking.unmark",
+      "verb": "Privacy::Marking.Unmark",
+      "role": "Deployment"
+    },
+    {
+      "scope": "privacy:subject_key.issue",
+      "verb": "Privacy::SubjectKey.Issue",
+      "role": "System"
+    },
+    {
+      "scope": "privacy:subject_key.shred",
+      "verb": "Privacy::SubjectKey.Shred",
+      "role": "Privacy officer"
+    }
+  ],
+  "roles": [
+    "Deployment",
+    "Privacy officer",
+    "System"
+  ]
+}

data/lib/hecks/fuzzing/domain_generator/block_rendering.rb

@@ -19,7 +19,7 @@ module Hecks
         end
 
         def string_body(name)
-          ["attribute :value, String, pattern: '[^ \\t\\n\\r]'",
+          ["attribute :value, String, matches: :present",
            "invariant(#{"a #{name} is not blank".inspect}) { !value.to_s.empty? }"]
         end
 

data/lib/hecks/gate/stages.yml

@@ -20,8 +20,11 @@
 # with `only=`: several of them write generated files and compare, so the stage is not meant to
 # run whole in one checkout.
 pre_push:
+  # HECKS_PROCESS_SPECS keeps the examples tagged `process` (they start child processes, so a plain
+  # `rspec` leaves them out) in the suite this stage runs.
   env:
     HECKS_ENVIRONMENT: memory
+    HECKS_PROCESS_SPECS: "1"
   checks:
     - id: rspec
       title: rspec (parallel)

data/lib/hecks/grammar/translation.oidc.json

@@ -0,0 +1,48 @@
+{
+  "audience": "Translation",
+  "scopes": [
+    {
+      "scope": "translation:map.declare",
+      "verb": "Translation::Map.Declare",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:map.draft",
+      "verb": "Translation::Map.Draft",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:map.seal",
+      "verb": "Translation::Map.Seal",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:map.supersede",
+      "verb": "Translation::Map.Supersede",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:rule.admit",
+      "verb": "Translation::Rule.Admit",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:rule.execute",
+      "verb": "Translation::Rule.Execute",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:rule.propose",
+      "verb": "Translation::Rule.Propose",
+      "role": "Author"
+    },
+    {
+      "scope": "translation:rule.retire",
+      "verb": "Translation::Rule.Retire",
+      "role": "Author"
+    }
+  ],
+  "roles": [
+    "Author"
+  ]
+}

data/lib/hecks/hecks/adapters/codebase/test_runner.rb

@@ -45,12 +45,23 @@ module Hecks
         # What the runner printed for the example, when it passed.
         def run_example(path, example)
           out = StringIO.new
-          status = Dir.chdir(@tree.root) { runner.call(["--example", example, path], out, out) }
+          status = Dir.chdir(@tree.root) { at_reaction_depth_zero { runner.call(["--example", example, path], out, out) } }
           raise ConsoleCapture::Failure, out.string.strip unless status.zero?
 
           out.string.strip
         end
 
+        # The runner is asked for from inside a command's own reaction cascade, and the dispatcher
+        # keeps that cascade's depth on the thread. An example starts at depth zero, as a plain run
+        # does, so a spec that cascades four deep is not cut off by the cascade that launched it.
+        def at_reaction_depth_zero
+          depth = Thread.current[:hecks_reaction_depth]
+          Thread.current[:hecks_reaction_depth] = 0
+          yield
+        ensure
+          Thread.current[:hecks_reaction_depth] = depth
+        end
+
         def runner
           return self.class.runner if self.class.runner
 

data/lib/hecks/hecks/adapters/deploy_toolchain.rb

@@ -74,7 +74,8 @@ module Hecks
         { report: { value: child(:lint, paths).dig(:output, :value) } }
       end
 
-      # Projects each domain's OIDC client and scope manifest into its `oidc.json`, through
+      # Projects each domain's OIDC client and scope manifest into its `oidc.json`, or into one
+      # `<chapter>.oidc.json` for each chapter of a directory that holds several, through
       # `hecks deploy oidc_manifest.project_oidc`.
       #
       # @param held [Hash] the `OidcManifest` record: `domains` (comma separated directories; every

data/lib/hecks/hecks/codebase.bluebook

@@ -38,13 +38,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -57,7 +57,7 @@ Hecks.bluebook "Hecks" do
 
     # A keyword of the language, or the keyword an argument belongs to.
     value_object "Word" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a word is named") { !value.to_s.empty? }
     end
@@ -94,7 +94,7 @@ Hecks.bluebook "Hecks" do
 
     # How a pairs argument is read, such as verbatim.
     value_object "Shape" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     lifecycle :status, default: "requested" do
@@ -641,13 +641,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -796,13 +796,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -971,13 +971,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -990,7 +990,7 @@ Hecks.bluebook "Hecks" do
 
     # A `CiGate` row of the Vocabulary chapter, by name.
     value_object "GateName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     lifecycle :status, default: "requested" do
@@ -1201,17 +1201,17 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Stage" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      attribute :value, String, matches: :snake_name
 
       invariant("a stage is named") { !value.to_s.empty? }
     end
@@ -1355,13 +1355,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -1391,12 +1391,12 @@ Hecks.bluebook "Hecks" do
 
     # A revision a code comparison is made against.
     value_object "Ref" do
-      attribute :value, String, pattern: '^[^ \t\n\r]+$'
+      attribute :value, String, matches: :no_whitespace
     end
 
     # A JSON file.
     value_object "FilePath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a file is named") { !value.to_s.empty? }
     end
@@ -1676,13 +1676,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -1891,13 +1891,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -2064,13 +2064,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -2090,19 +2090,19 @@ Hecks.bluebook "Hecks" do
 
     # A CI run's number.
     value_object "RunId" do
-      attribute :value, String, pattern: '^[0-9]+$'
+      attribute :value, String, matches: :digits
     end
 
     # A file, relative to the checkout or absolute.
     value_object "FilePath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a file is named") { !value.to_s.empty? }
     end
 
     # Part of an example's description.
     value_object "ExampleText" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("an example is named") { !value.to_s.empty? }
     end
@@ -2114,7 +2114,7 @@ Hecks.bluebook "Hecks" do
 
     # A regular expression naming the specs to leave out.
     value_object "ExcludePattern" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     # The tag filter, as the test runner spells it.
@@ -2390,13 +2390,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -2424,7 +2424,7 @@ Hecks.bluebook "Hecks" do
 
     # The name of one field of a construct.
     value_object "FieldName" do
-      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+      attribute :value, String, matches: :snake_name
     end
 
     # A local port a server listens on.
@@ -2633,13 +2633,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -2652,7 +2652,7 @@ Hecks.bluebook "Hecks" do
 
     # One word of a fact: a branch, a commit, whether a tag stands.
     value_object "Word" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Version" do
@@ -2968,13 +2968,13 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a run is named") { !value.to_s.empty? }
     end
 
     value_object "Operation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Switch" do
@@ -2987,7 +2987,7 @@ Hecks.bluebook "Hecks" do
 
     # A branch name, or a commit.
     value_object "Word" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     # How long a lane has stood behind the lane it follows, or how long its row lets it.

data/lib/hecks/hecks/custodian.bluebook

@@ -27,14 +27,14 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "OperationKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("an operation is named") { !value.to_s.empty? }
     end
 
     # What the operation acts on: a domain directory, or a behaviors file or directory.
     value_object "Subject" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Script" do
@@ -42,7 +42,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "Verb" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     # One `name=value` word of the verb a run dispatches.
@@ -59,7 +59,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "HeaderName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Scheme" do
@@ -71,7 +71,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "PayloadFile" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Output" do
@@ -84,11 +84,11 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "PersonName" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "RoleName" do
-      attribute :value, String, pattern: '^[^ \t\n\r]+$'
+      attribute :value, String, matches: :no_whitespace
     end
 
     lifecycle :status, default: "requested" do
@@ -361,7 +361,7 @@ Hecks.bluebook "Hecks" do
 
     # The file listing the eras that should be running, one per line.
     value_object "ExpectedFile" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Seconds" do
@@ -371,7 +371,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "EraId" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "VersionText" do
@@ -546,14 +546,14 @@ policy "RecordTheEra" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a change is named") { !value.to_s.empty? }
     end
 
     # The domain whose journal is changed: its directory.
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "OperationName" do
@@ -574,7 +574,7 @@ policy "RecordTheEra" do
 
     # Aggregate names, comma separated; every aggregate that keeps a journal when absent.
     value_object "AggregateList" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "Switch" do
@@ -588,11 +588,11 @@ policy "RecordTheEra" do
     # The rehearsal a compute or rekey edge is approved on: the snapshot it ran against, the host
     # that ran it, whether it passed, and when.
     value_object "Snapshot" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     value_object "HostVersion" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Verdict" do

data/lib/hecks/hecks/hecks.bluebook

@@ -14,7 +14,7 @@ Hecks.bluebook "Hecks" do
     identified_by :version
 
     value_object "FindingKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     value_object "Version" do
@@ -94,7 +94,7 @@ Hecks.bluebook "Hecks" do
     identified_by :digest
 
     value_object "Digest" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a digest is present") { !value.to_s.empty? }
     end

data/lib/hecks/hecks/rehearsal.bluebook

@@ -53,14 +53,14 @@ Hecks.bluebook "Hecks" do
     identified_by :run
 
     value_object "RunKey" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a rehearsal is named") { !value.to_s.empty? }
     end
 
     # The domain's directory: where its bluebooks and its `.world` stand.
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
     end
 
     # The Hecks the rehearsal must run on: a release (`3.9.0`) or a commit, whole or a prefix.
@@ -69,7 +69,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "HostVersion" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
     end
 
     # Which strategy the subject's world named for the copy of its data.