hecks 3.13.0 → 4.0.0

data/lib/hecks/quality_control/adapters/agent_profile.rb

@@ -1,93 +1,47 @@
 # frozen_string_literal: true
 
-require "tmpdir"
-
 module Hecks
   module Adapters
-    # What one `Agent` run may do: which tools it holds, where it may write, what it may reach on
-    # the network, which environment variables it sees and how long it may run.
+    # What one `Agent` run may do: which tools it holds, where it may write, which environment
+    # variables it sees and how long it may run.
     #
-    # Confinement uses the macOS sandbox. Where there is none, a confined run refuses to start
-    # rather than run unconfined.
+    # Confinement is the permission rules of the `claude` command itself, so a run keeps the
+    # user's own login. Only the default `claude` command understands them; `Agent` refuses to
+    # run any other command under a profile.
     class AgentProfile
-      # What the network rule lets through: nothing, outbound HTTPS and name lookups, or anything.
-      NETWORKS = %i[none https any].freeze
-
-      # How a run is confined: under the operating system's sandbox, or by the permission rules
-      # of the `claude` command itself. Only the second leaves the user's own login usable, since
-      # the sandbox refuses the keychain and `~/.claude`.
-      CONFINEMENTS = %i[sandbox permissions].freeze
-
       # The variables every confined agent sees besides the ones its profile names.
       BASE_ENV = %w[PATH HOME USER LOGNAME SHELL LANG LC_ALL TERM TMPDIR].freeze
 
-      # The tools that write files; a permissions-confined run holds them only through path rules.
+      # The tools that write files; a confined run holds them only through path rules.
       WRITING_TOOLS = %w[Write Edit MultiEdit NotebookEdit].freeze
 
-      # Home-relative places an agent may not read: credentials and the harness's own state.
-      CREDENTIAL_PATHS = %w[
-        .ssh .aws .gnupg .claude .config/gh .config/op .gem/credentials .netrc Library/Keychains
-      ].freeze
-
-      SANDBOX = "/usr/bin/sandbox-exec"
-
-      # The keywords `new` takes besides the four lists, with what each defaults to.
-      LIMIT_DEFAULTS = { timeout: nil, budget: nil, confinement: :sandbox }.freeze
-
       # @return [Array<String>] the tools the agent is given
       attr_reader :tools
-      # @return [Array<String>] the directories the agent may write, besides the temp directory
+      # @return [Array<String>] the directories the agent may write
       attr_reader :writable
-      # @return [Symbol] one of `NETWORKS`
-      attr_reader :network
       # @return [Array<String>] the environment variable names the agent may see besides `BASE_ENV`
       attr_reader :env
       # @return [Integer, nil] seconds the run may take; nil for no limit
       attr_reader :timeout
       # @return [Float, nil] the most the run may spend, in dollars, for an agent that takes one
       attr_reader :budget
-      # @return [Symbol] one of `CONFINEMENTS`
-      attr_reader :confinement
 
       # @param tools [Array<String>] the tools the agent is given
       # @param writable [Array<String>] directories the agent may write
-      # @param network [Symbol] one of `NETWORKS`
       # @param env [Array<String>] environment variable names to pass through
-      # @param limits [Hash] `timeout:` (Integer, nil) seconds the run may take, `budget:`
-      #   (Float, nil) dollars it may spend, `confinement:` one of `CONFINEMENTS` (`network`
-      #   applies to the sandbox only)
-      # @raise [ArgumentError] when `network` or `confinement` is not one it knows
-      def initialize(tools: [], writable: [], network: :none, env: [], **limits)
-        limits = LIMIT_DEFAULTS.merge(reject_unknown(limits))
-        ensure_known(:network, NETWORKS, network)
-        ensure_known(:confinement, CONFINEMENTS, limits[:confinement])
+      # @param timeout [Integer, nil] seconds the run may take
+      # @param budget [Float, nil] dollars it may spend
+      def initialize(tools: [], writable: [], env: [], timeout: nil, budget: nil)
         @tools = tools.dup.freeze
         @writable = writable.dup.freeze
-        @network = network
         @env = env.dup.freeze
-        @timeout, @budget, @confinement = limits.values_at(:timeout, :budget, :confinement)
-      end
-
-      # @return [Boolean] whether this profile is enforced by the operating system's sandbox
-      def sandboxed?
-        confinement == :sandbox
-      end
-
-      # @return [Boolean] whether this machine can apply this profile's confinement
-      def available?
-        !sandboxed? || File.executable?(SANDBOX)
-      end
-
-      # @param words [Array<String>] the agent's command
-      # @return [Array<String>] `words`, run under the sandbox with this profile's policy; the
-      #   words unchanged when the confinement is the command's own permission rules
-      def confine(words)
-        sandboxed? ? [SANDBOX, "-p", policy, *words] : words
+        @timeout = timeout
+        @budget = budget
       end
 
       # @return [String] the `claude` permission mode this profile runs under
       def permission_mode
-        sandboxed? ? "acceptEdits" : "dontAsk"
+        "dontAsk"
       end
 
       # @param source [Hash{String => String}] the environment to take values from
@@ -96,79 +50,27 @@ module Hecks
         source.to_h.slice(*BASE_ENV, *env)
       end
 
-      # The `claude` flags this profile's tools and budget become.
+      # The `claude` flags this profile's tools and budget become. The writing tools are held only
+      # through an `Edit` rule per writable directory, which every file-writing tool answers to.
       #
       # @return [Array<String>]
       def tool_flags
         flags = tools.empty? ? [] : ["--tools", tools.join(","), "--allowedTools", *allowed_tools]
-        flags += ["--strict-mcp-config"] unless sandboxed?
+        flags += ["--strict-mcp-config"]
         flags + (budget ? ["--max-budget-usd", budget.to_s] : [])
       end
 
-      # @return [String] the sandbox policy: reads open but for credentials, writes where allowed
-      def policy
-        [
-          "(version 1)", "(allow default)",
-          "(deny file-write*)", write_rule, "(deny file-read*#{paths_clause(credential_paths)})",
-          *network_rules
-        ].join("\n")
-      end
-
       private
 
-      # The tools allowed without asking. A permissions-confined run holds the writing tools only
-      # through an `Edit` rule per writable directory, which every file-writing tool answers to.
       def allowed_tools
-        return [tools.join(",")] if sandboxed?
-
         tools - WRITING_TOOLS + writable.map { |path| "Edit(/#{real(path)}/**)" }
       end
 
-      def write_rule
-        allowed = [real(Dir.tmpdir), *writable.map { |path| real(path) }]
-        devices = '(literal "/dev/null") (literal "/dev/tty") (regex #"^/dev/fd/")'
-        "(allow file-write*#{paths_clause(allowed)} #{devices})"
-      end
-
-      def credential_paths
-        CREDENTIAL_PATHS.map { |path| File.join(Dir.home, path) }
-      end
-
-      def paths_clause(paths)
-        paths.map { |path| " (subpath #{quote(path)})" }.join
-      end
-
-      def network_rules
-        case network
-        when :any then []
-        when :https then ["(deny network*)", '(allow network-outbound (remote tcp "*:443") (remote udp "*:53"))',
-                          '(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder")))']
-        else ["(deny network*)"]
-        end
-      end
-
-      def reject_unknown(limits)
-        unknown = limits.keys - LIMIT_DEFAULTS.keys
-        return limits if unknown.empty?
-
-        raise ArgumentError, "unknown keyword#{"s" if unknown.size > 1}: #{unknown.map(&:inspect).join(", ")}"
-      end
-
-      def ensure_known(name, allowed, value)
-        return if allowed.include?(value)
-
-        raise ArgumentError, "#{name} must be one of #{allowed.inspect}, not #{value.inspect}"
-      end
-
       def real(path)
         File.realpath(path)
       rescue SystemCallError
         File.expand_path(path)
       end
-
-      def quote(path)
-        %("#{path.gsub("\\", "\\\\\\\\").gsub('"', '\\"')}")
-      end
     end
   end
 end

data/lib/hecks/quality_control/cli/qa_mine_combinations.rb

@@ -116,7 +116,7 @@ module Hecks
       # The profile `--confine` runs the agent under: it writes only the candidates directory.
       def confinement_profile
         FileUtils.mkdir_p(@out_dir)
-        Hecks::Adapters::AgentProfile.new(confinement: :permissions, tools: CONFINED_TOOLS, writable: [@out_dir],
+        Hecks::Adapters::AgentProfile.new(tools: CONFINED_TOOLS, writable: [@out_dir],
                                           timeout: CONFINED_TIMEOUT, budget: CONFINED_BUDGET)
       end
 

data/lib/hecks/quality_control/quality_control.bluebook

@@ -54,13 +54,13 @@ Hecks.bluebook "QualityControl" do
     attribute :reason,     TargetReason
 
     value_object "TargetReference" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a target is referenced") { !value.to_s.empty? }
     end
 
     # Required: a name can be disputed, a path can be opened.
     value_object "TargetPath" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a target says where it is") { !value.to_s.empty? }
     end
 
@@ -87,7 +87,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "TargetReason" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("shelving a target says why") { !value.to_s.empty? }
     end
 
@@ -99,7 +99,7 @@ Hecks.bluebook "QualityControl" do
 
     # One mode name, as `EligibleFor`'s argument; a query attribute, never stored.
     value_object "Capability" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a mode is named") { !value.to_s.empty? }
     end
 
@@ -300,7 +300,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a domain is named by its path") { !value.to_s.empty? }
     end
@@ -361,12 +361,12 @@ Hecks.bluebook "QualityControl" do
     attribute :checks,    list_of(Check)
 
     value_object "SweepReference" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a sweep is referenced") { !value.to_s.empty? }
     end
 
     value_object "Engineer" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a sweep says who ran it") { !value.to_s.empty? }
     end
 
@@ -381,13 +381,13 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "SweepNotes" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       # The number is in the sentence because the sentence is the refusal message.
       invariant("a sweep says what it learned, in at least 40 characters") { value.to_s.size >= 40 }
     end
 
     value_object "WaiverReason" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a waived gate says why") { !value.to_s.empty? }
     end
 
@@ -395,7 +395,7 @@ Hecks.bluebook "QualityControl" do
     # literals, so `spec/quality_control_spec.rb` pins the two equal. "nobody" is refused: unsigned
     # is anonymous.
     value_object "WaivedBy" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a gate is waived by a person, never by the loop") { value != "qa_sweep" }
       invariant("a waiver is signed") { value != "nobody" }
     end
@@ -418,13 +418,13 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "Subject" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a check names what it put to the system") { !value.to_s.empty? }
     end
 
     # Written before the answer exists: an expectation fitted to the answer cannot be surprised.
     value_object "Expectation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a check says what it expected") { !value.to_s.empty? }
     end
 
@@ -637,37 +637,37 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "DomainPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a domain is named by its path") { !value.to_s.empty? }
     end
 
     value_object "DataPath" do
-      attribute :value, String, pattern: '[^\t\n\r]'
+      attribute :value, String, matches: :not_empty
 
       invariant("a data directory is named by its path") { !value.to_s.empty? }
     end
 
     value_object "DatabaseName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a database is named") { !value.to_s.empty? }
     end
 
     value_object "RoleName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a role is named") { !value.to_s.empty? }
     end
 
     value_object "SchemaName" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a schema is named") { !value.to_s.empty? }
     end
 
     value_object "StepVerb" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a step names its verb") { !value.to_s.empty? }
     end
@@ -770,7 +770,7 @@ Hecks.bluebook "QualityControl" do
     attribute :window,        StaleAfter
 
     value_object "BugReference" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a bug is referenced") { !value.to_s.empty? }
     end
 
@@ -783,56 +783,56 @@ Hecks.bluebook "QualityControl" do
     # value object sharing a word with any aggregate resolves to that class once the other domain
     # boots.
     value_object "BugTitle" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a bug is titled") { !value.to_s.empty? }
     end
 
     # Required at `Log`, which is what makes the one absolute rule absolute.
     value_object "Demonstration" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a bug is proven by a test somebody can re-run") { !value.to_s.empty? }
     end
 
     value_object "Symptom" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a bug says what actually happened") { !value.to_s.empty? }
     end
 
     value_object "Expectation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a bug says what should have happened") { !value.to_s.empty? }
     end
 
     value_object "BugSite" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an investigation names where the bug lives") { !value.to_s.empty? }
     end
 
     value_object "BugCause" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an investigation says why the code is wrong") { !value.to_s.empty? }
     end
 
     # 7 to 40 hex: a fix that lives only in a working tree is not a fix.
     value_object "CommitRef" do
-      attribute :value, String, pattern: '^[0-9a-fA-F]{7,40}$'
+      attribute :value, String, matches: :git_sha
     end
 
     # What was actually run, e.g. "rspec --order random, 1335 examples, 0 failures, seed 12345":
     # a count and a seed are checkable, "tests pass" is not.
     value_object "Verification" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a verification says what was actually run") { !value.to_s.empty? }
     end
 
     value_object "BugReason" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("stopping on a bug says why") { !value.to_s.empty? }
     end
 
     # Who decides and what would unblock it, so "deferred" does not become "forgotten".
     value_object "NextStep" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("stopping on a bug says what would move it") { !value.to_s.empty? }
     end
 
@@ -842,14 +842,14 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "WaiverReason" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a waived gate says why") { !value.to_s.empty? }
     end
 
     # Redeclared, as elsewhere in this file; the "qa_sweep" literal is pinned to AUTOMATED_ENGINEER
     # by spec.
     value_object "WaivedBy" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a gate is waived by a person, never by the loop") { value != "qa_sweep" }
       invariant("a waiver is signed") { value != "nobody" }
     end
@@ -881,7 +881,7 @@ Hecks.bluebook "QualityControl" do
     # Not an `Engineer`: that type defaults to "nobody" (an unclaimed bug is held by nobody), which
     # would let a report omit its submitter. This type has no default and refuses "nobody".
     value_object "Submitter" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
 
       invariant("a bug is reported by somebody") { value != "nobody" }
     end
@@ -1237,27 +1237,27 @@ Hecks.bluebook "QualityControl" do
     attribute :reason,      AngleReason
 
     value_object "AngleReference" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an angle is referenced") { !value.to_s.empty? }
     end
 
     # The number is in the sentence because the sentence is the refusal; 60 characters trips a
     # stub.
     value_object "AnglePremise" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an angle says enough to be acted on without its proposer in the room, in at least 60 characters") { value.to_s.size >= 60 }
     end
 
     # A Bug reference, ADR number or named gap that a reader can check for themselves.
     value_object "AngleCitation" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an angle cites something concrete, not a mood") { !value.to_s.empty? }
     end
 
     # Not an `Engineer`, for the reason `Submitter` is not: that default would let authorship go
     # unrecorded.
     value_object "Proposer" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an angle is proposed by somebody") { value != "nobody" }
     end
 
@@ -1268,13 +1268,13 @@ Hecks.bluebook "QualityControl" do
 
     # What came of it (a Target, a PR number, a domain path); set once, at `Build`.
     value_object "AngleResolution" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a built angle says what actually got built") { !value.to_s.empty? }
     end
 
     # Redeclared as `Target::Shelve` does: a discard with no reason looks like a lead nobody read.
     value_object "AngleReason" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("discarding an angle says why") { !value.to_s.empty? }
     end
 
@@ -1401,7 +1401,7 @@ Hecks.bluebook "QualityControl" do
     attribute :max_attempts, MaxAttempts
 
     value_object "TicketReference" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a ticket is referenced") { !value.to_s.empty? }
     end
 
@@ -1410,7 +1410,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "TicketTitle" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a ticket is titled") { !value.to_s.empty? }
     end
 
@@ -1421,7 +1421,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "TicketBody" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a ticket says something") { !value.to_s.empty? }
     end
 
@@ -1647,22 +1647,22 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "PatchUrl" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a patch says where it lives") { !value.to_s.empty? }
     end
 
     value_object "PatchBranch" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a patch says which branch it is on") { !value.to_s.empty? }
     end
 
     # Recorded at `Open` so the commit is in hand when the PR needs checking, as `Bug.commit` is.
     value_object "CommitRef" do
-      attribute :value, String, pattern: '^[0-9a-fA-F]{7,40}$'
+      attribute :value, String, matches: :git_sha
     end
 
     value_object "PatchTitle" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a patch is titled") { !value.to_s.empty? }
     end
 
@@ -1840,23 +1840,23 @@ Hecks.bluebook "QualityControl" do
     end
 
     value_object "ImprovementUrl" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an improvement says where it lives") { !value.to_s.empty? }
     end
 
     value_object "ImprovementBranch" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an improvement says which branch it is on") { !value.to_s.empty? }
     end
 
     # Redeclared per aggregate. Absent until `Land`: there is nothing to watch until a commit
     # exists.
     value_object "CommitRef" do
-      attribute :value, String, pattern: '^[0-9a-fA-F]{7,40}$'
+      attribute :value, String, matches: :git_sha
     end
 
     value_object "ImprovementTitle" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("an improvement is titled") { !value.to_s.empty? }
     end
 
@@ -1977,11 +1977,11 @@ Hecks.bluebook "QualityControl" do
     attribute :summary, RunSummary
 
     value_object "CommitRef" do
-      attribute :value, String, pattern: '^[0-9a-fA-F]{7,40}$'
+      attribute :value, String, matches: :git_sha
     end
 
     value_object "RunSummary" do
-      attribute :value, String, pattern: '[^ \t\n\r]'
+      attribute :value, String, matches: :present
       invariant("a run says what it ran and what came back") { !value.to_s.empty? }
     end
 

data/lib/hecks/runtime/loader/boot_steps.rb

@@ -43,7 +43,6 @@ module Hecks
           gates = BootGates.new
           load_bound_adapters!(registry)
           Ports::Persistence.each_plugin { |plugin| plugin.contribute_boot_gates(registry, gates) }
-          check_compute_rules_backstop!(registry)
 
           gates.run!(:pre_verify, registry, directory)
           registry.verify!
@@ -67,25 +66,6 @@ module Hecks
           (bound + default).each { |name| load_adapter(registry, name) }
         end
 
-        # A backstop only: fires when a translation declares a `computes`/
-        # `rekeys` rule but no persistence plugin is loaded to interpret it.
-        # Any loaded plugin's own compute-rules gate refuses earlier, by name,
-        # whenever one is loaded — this only runs when nothing was.
-        def check_compute_rules_backstop!(registry)
-          return if Ports::Persistence.plugins_loaded?
-
-          registry.translations.each do |translation|
-            translation.aggregates.each do |aggregate|
-              next if aggregate.computes.empty? && aggregate.rekeys.empty?
-
-              raise WiringError,
-                    "cannot boot #{translation.domain}::#{aggregate.name}: a compute/rekey rule is declared, but no " \
-                    "persistence plugin that can interpret it is loaded (e.g. require " \
-                    "\"hecks/ports/persistence/plugins/era\")"
-            end
-          end
-        end
-
         private
 
         def load_adapter(registry, name)

data/lib/hecks/runtime/outbox.rb

@@ -2,6 +2,7 @@ require "json"
 require "securerandom"
 require "time"
 require_relative "event"
+require_relative "value"
 require_relative "../naming"
 
 module Hecks
@@ -48,19 +49,11 @@ module Hecks
           name:        hash[:name],
           aggregate:   hash[:aggregate],
           id:          hash[:id],
-          payload:     deep_symbolize(hash[:payload] || {}),
+          payload:     Value.deep_symbolize(hash[:payload] || {}),
           occurred_at: hash[:occurred_at],
           correlation: hash[:correlation]
         ).emit!
       end
-
-      def deep_symbolize(value)
-        case value
-        when Hash  then value.to_h { |k, v| [k.to_sym, deep_symbolize(v)] }
-        when Array then value.map { |element| deep_symbolize(element) }
-        else value
-        end
-      end
     end
   end
 end

data/lib/hecks/runtime/port_operation_interpreter.rb

@@ -101,15 +101,7 @@ module Hecks
       def spread(answer)
         return { answered: answer } unless answer.is_a?(Hash)
 
-        answer.to_h { |key, value| [key.to_sym, deep_symbolize(value)] }
-      end
-
-      def deep_symbolize(value)
-        case value
-        when Hash  then value.to_h { |k, v| [k.to_sym, deep_symbolize(v)] }
-        when Array then value.map { |element| deep_symbolize(element) }
-        else value
-        end
+        Value.deep_symbolize(answer)
       end
 
       # The record, if there is one. A missing record is not an error here: the ask still