hecks 3.2.1 → 3.4.0

data/lib/hecks/hecks/adapters/git.rb

@@ -60,6 +60,55 @@ module Hecks
         { report: { value: out.string } }
       end
 
+      # Checks a project's vendored packages against their `bluebook.lock` files and describes
+      # them as the manifest a client image carries, through `Hecks::EmbryonautBluebook::Manifest`.
+      #
+      # The manifest records the project's own commit and whether its tree has uncommitted changes,
+      # read from the repository the project stands in (`unknown` outside one).
+      #
+      # @param held [Hash] the `Package` query's arguments: `root` (the project; the current
+      #   directory when absent)
+      # @return [Hash{Symbol => String}] `text:` the manifest as JSON
+      # @raise [Runtime::NotFound] naming each package whose files disagree with its lock
+      def verify(**held)
+        root = File.expand_path(plain(held[:root]) || Dir.pwd)
+        raise Runtime::NotFound, "#{root} is not a directory" unless File.directory?(root)
+
+        { text: EmbryonautBluebook::Manifest.new(root, built_from: built_from(root)).to_json_text }
+      rescue EmbryonautBluebook::Manifest::Mismatch => e
+        raise Runtime::NotFound, e.message
+      end
+
+      # Judges every package of a bluebook registry against its latest release, through
+      # `Hecks::EmbryonautBluebook::Registry#check`.
+      #
+      # @param held [Hash] the `Registry` query's arguments: `root` (the registry; the current
+      #   directory when absent)
+      # @return [Hash{Symbol => String}] `text:` the notes and `versions ok`
+      # @raise [Runtime::NotFound] naming each package at fault, or when `root` is no repository
+      def check(**held)
+        report = registry(held).check
+        raise Runtime::NotFound, report.to_s unless report.ok?
+
+        { text: report.to_s }
+      rescue Vendoring::Error => e
+        raise Runtime::NotFound, e.message
+      end
+
+      # Tags a package of a bluebook registry at the version its `bluebook.yml` carries, through
+      # `Hecks::EmbryonautBluebook::Registry#release`. The tag is made in the local repository and
+      # never pushed.
+      #
+      # @param held [Hash] the `Registry` record: `package`, and `root` (the current directory when
+      #   absent)
+      # @return [Hash{Symbol => Hash}] `report:` the tag made and the command that publishes it
+      # @raise [ConsoleCapture::Failure] when the package breaks a release rule
+      def tag(**held)
+        { report: { value: registry(held).release(plain(held[:package])).to_s } }
+      rescue Vendoring::Error => e
+        raise ConsoleCapture::Failure, e.message
+      end
+
       # Who the repository at a directory commits as: its configured name and email.
       #
       # @param chdir [String, nil] a directory inside the repository; the current one when nil
@@ -87,6 +136,16 @@ module Hecks
 
       private
 
+      def registry(held)
+        EmbryonautBluebook::Registry.new(File.expand_path(plain(held[:root]) || Dir.pwd))
+      end
+
+      def built_from(root)
+        head = capture("rev-parse", "HEAD", chdir: root)
+        status = capture("status", "--porcelain", "--", ".", chdir: root)
+        { "commit" => head.ok? ? head.out.strip : "unknown", "dirty" => status.ok? && !status.out.strip.empty? }
+      end
+
       def plain(argument) = argument.is_a?(Hash) ? argument[:value] : argument
 
       # A source that is not a repository is worded here; the vendoring's own refusal for it is a

data/lib/hecks/hecks/adapters/in_process_access.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "first_admin"
+
+module Hecks
+  module Adapters
+    # What the `DomainRuntime` port's adapter does when an `Operation` asks it to give a domain its
+    # first administrator.
+    module InProcessAccess
+      # Boots the domain and grants the first administrator through its membership chapter.
+      #
+      # @param held [Hash] the `Operation` record: `subject` (the domain), `email`, and optionally
+      #   `name` and `role`
+      # @return [Hash{Symbol => Hash}] `output:` the sentence saying who now holds which role
+      # @raise [Runtime::NotFound] if the domain cannot be found or has no membership chapter, or an
+      #   administrator already exists
+      def bootstrap(**held)
+        result = FirstAdmin.new(boot(held[:subject])).call(
+          email: plain(held[:email]), name: plain(held[:name]), role: plain(held[:role])
+        )
+        output(result.to_s)
+      end
+    end
+  end
+end

data/lib/hecks/hecks/adapters/in_process_boot.rb

@@ -9,6 +9,7 @@ require_relative "../../cli/stores"
 require_relative "../../cli/shape"
 require_relative "../../cli/history"
 require_relative "in_process_operations"
+require_relative "in_process_access"
 
 module Hecks
   module Adapters
@@ -25,6 +26,7 @@ module Hecks
     # a projection refresh, a behaviors run, a smoke test and a bounded follow.
     class InProcessBoot
       include InProcessOperations
+      include InProcessAccess
 
       # Accepts the arguments every driven adapter is built with and keeps none of them.
       #

data/lib/hecks/hecks/adapters/rust_toolchain.rb

@@ -19,9 +19,9 @@ module Hecks
     # minutes, so it starts as a child through `ProcessPool`.
     class RustToolchain
       # The `Hecks::RustBuild` tool each ask runs.
-      TOOLS = { generate: "project_rust", wasm: "project_wasm", browser_wasm: "project_wasm_browser",
-                conform: "rust_conformance", replay: "rust_conformance_fuzz",
-                coverage: "rust_coverage" }.freeze
+      TOOLS = { generate: "project_rust", wasm: "project_wasm", host: "project_host",
+                browser_wasm: "project_wasm_browser", conform: "rust_conformance",
+                replay: "rust_conformance_fuzz", coverage: "rust_coverage" }.freeze
 
       # The load path the benchmark child runs with: this checkout's or gem's `lib/`.
       LIB = File.expand_path("../../..", __dir__)
@@ -73,6 +73,21 @@ module Hecks
         child(:wasm, [plain(held[:domain])])
       end
 
+      # Generates the domain, compiles it to a `wasm32-wasip1` module, builds the host binary from
+      # the workspace and stages the three files in a directory an image copies from.
+      #
+      # @param held [Hash] the `Build` record: `domain`, `target` (the machine's own when absent)
+      #   and `stage_dir` (`.hecks/host/<target>/` when absent)
+      # @return [Hash{Symbol => Hash}] `output:` where the files were staged
+      # @raise [ConsoleCapture::Failure] when the toolchain or the target is missing, or a step
+      #   fails
+      def host(**held)
+        argv = [plain(held[:domain])]
+        argv << "--target=#{plain(held[:target])}" if plain(held[:target])
+        argv << "--stage=#{plain(held[:stage_dir])}" if plain(held[:stage_dir])
+        child(:host, argv)
+      end
+
       # Generates the domain, then compiles it to an ES module for a browser through wasm-bindgen.
       #
       # @param held [Hash] the `Build` record: `domain`

data/lib/hecks/hecks/adapters/site_toolchain.rb

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 
+require "json"
 require_relative "console_capture"
+require_relative "shell"
 require_relative "codebase/tree"
 require_relative "codebase/ruby_child"
+require "hecks/tools"
+require "hecks/tools/site_routes"
+require "hecks/projections/site/live_edge"
 
 module Hecks
   module Adapters
@@ -44,8 +49,70 @@ module Hecks
         { output: { value: result.out } }
       end
 
+      # Compares the CloudFront behaviours a project's edge generates with a live distribution's.
+      # The live configuration is read from a saved `get-distribution-config` answer (`live`) or
+      # fetched with that one read-only call (`distribution`, the distribution's id); nothing is
+      # changed on either side.
+      #
+      # @param held [Hash] the `SiteProjection` record: `domain`, and `live` or `distribution`,
+      #   with `expect_new` (path patterns, comma separated) and `refs` (`!Ref Name=id` words,
+      #   comma separated) when set
+      # @return [Hash{Symbol => Hash}] `output:` the report of a distribution that matches
+      # @raise [ConsoleCapture::Failure] when the project has no edge, the live configuration
+      #   cannot be read, or the two differ; the message is the report
+      def compare(**held)
+        edge = edge_of(located(:domain, held[:domain]))
+        live = live_configuration(held)
+        live_edge = Projections::Site::LiveEdge
+        comparison = live_edge.new(edge, live, expect_new: words(held[:expect_new]),
+                                               refs:       live_edge.refs_from(plain(held[:refs]))).call
+        raise ConsoleCapture::Failure, comparison.to_s unless comparison.clean?
+
+        { output: { value: comparison.to_s } }
+      end
+
       private
 
+      # The project's checked edge, read the way `project_site` reads it.
+      def edge_of(root)
+        registry = nil
+        outcome = ConsoleCapture.capture { registry = Tools::SiteRoutes.registry_for(root) }
+        raise ConsoleCapture::Failure, outcome.output.strip unless outcome.ok?
+
+        site = Projections::Site
+        chapter = site::Table.chapter(registry)
+        table = site::Table.read(chapter, registry: registry)
+        site::Edge.read(chapter, table: table, vocabulary: site::Table.vocabulary(registry)) ||
+          raise(ConsoleCapture::Failure, "#{root} declares no Edge rows")
+      rescue Projections::Site::Table::Invalid => e
+        raise ConsoleCapture::Failure, e.message
+      end
+
+      def live_configuration(held)
+        file = plain(held[:live])
+        id = plain(held[:distribution])
+        text = file ? read_saved(file) : fetch(id)
+        JSON.parse(text)
+      rescue JSON::ParserError => e
+        raise ConsoleCapture::Failure, "the live configuration is not JSON: #{e.message.lines.first.strip}"
+      end
+
+      def read_saved(path)
+        File.read(File.expand_path(path))
+      rescue SystemCallError => e
+        raise ConsoleCapture::Failure, "cannot read the live configuration: #{e.message}"
+      end
+
+      # The one AWS call: reading a distribution's configuration.
+      def fetch(id)
+        result = Shell.new.capture("aws", "cloudfront", "get-distribution-config", "--id", id.to_s)
+        return result.out if result.ok?
+
+        raise ConsoleCapture::Failure, "aws cloudfront get-distribution-config failed: #{message_of(result)}"
+      end
+
+      def words(argument) = plain(argument).to_s.split(",").map(&:strip).reject(&:empty?)
+
       def message_of(result)
         text = [result.err, result.out].map(&:strip).reject(&:empty?).join("\n")
         text.empty? ? "the tool ended with status #{result.status.exitstatus}" : text

data/lib/hecks/hecks/codebase.behaviors

@@ -85,6 +85,12 @@ Hecks.behaviors "Codebase" do
     expect refused: "must match"
   end
 
+  test "ProjectToolsDoc refuses a run that is not named" do
+    tests "ProjectToolsDoc", on: "RegenerationRun"
+    input run: { value: "" }
+    expect refused: "must match"
+  end
+
   test "DecideCiGate refuses a run that is not named" do
     tests "DecideCiGate", on: "RegenerationRun"
     input run: { value: "" }, gate: { value: "runtime_changed" }

data/lib/hecks/hecks/codebase.bluebook

@@ -1027,6 +1027,22 @@ Hecks.bluebook "Hecks" do
       emits ProjectCiGatesRequested
     end
 
+    command "ProjectToolsDoc" do
+      role "Maintainer"
+      goal "Write the launcher forms of docs/tools.md from the RetiredScript rows, or with check only compare them"
+
+      attribute :check,   Switch, optional: true
+      attribute :run,     RunKey
+      attribute :confirm, Switch, optional: true
+
+      sets :check
+      sets :run
+      sets :confirm
+      sets :operation, to: "project_tools_doc"
+
+      emits ProjectToolsDocRequested
+    end
+
     command "DecideCiGate" do
       role "Maintainer"
       goal "Say whether this run's change touches what a CiGate row guards, as the gated job's detector"
@@ -1105,6 +1121,11 @@ Hecks.bluebook "Hecks" do
     trigger RegenerationRun::SourceTree::Examine, with: { run: :run }
   end
 
+  policy "ExamineWhenProjectToolsDocRequested" do
+    on      "RegenerationRun.ProjectToolsDocRequested"
+    trigger RegenerationRun::SourceTree::Examine, with: { run: :run }
+  end
+
   policy "ExamineWhenDecideCiGateRequested" do
     on      "RegenerationRun.DecideCiGateRequested"
     trigger RegenerationRun::SourceTree::Examine, with: { run: :run }

data/lib/hecks/hecks/custodian.behaviors

@@ -176,4 +176,10 @@ Hecks.behaviors "Custodian" do
     input domain: { value: "examples/pizzas" }, run: { value: "" }
     expect refused: "must match"
   end
+
+  test "BuildHost refuses a target that is not a triple" do
+    tests "BuildHost", on: "Build"
+    input domain: { value: "examples/pizzas" }, run: { value: "host" }, target: { value: "arm64" }
+    expect refused: "must match"
+  end
 end

data/lib/hecks/hecks/custodian.bluebook

@@ -238,6 +238,9 @@ Hecks.bluebook "Hecks" do
     attribute :payload_file, PayloadFile, optional: true
     attribute :health_path,  RoutePath,  optional: true
     attribute :state_path,   RoutePath,  optional: true
+    attribute :email,        Email,      optional: true
+    attribute :name,         PersonName, optional: true
+    attribute :role,         RoleName,   optional: true
     attribute :output,       Output,     optional: true
     attribute :refusal,      Output,     optional: true
     identified_by :run
@@ -294,6 +297,19 @@ Hecks.bluebook "Hecks" do
       attribute :value, String
     end
 
+    # Who the first administrator is: a person of the domain's membership chapter.
+    value_object "Email" do
+      attribute :value, String, pattern: '^[^ \t\n\r@]+@[^ \t\n\r@]+$'
+    end
+
+    value_object "PersonName" do
+      attribute :value, String, pattern: '[^\t\n\r]'
+    end
+
+    value_object "RoleName" do
+      attribute :value, String, pattern: '^[^ \t\n\r]+$'
+    end
+
     lifecycle :status, default: "requested" do
       transition "Succeed" => "succeeded", from: "requested"
       transition "Fail"    => "failed",    from: "requested"
@@ -404,6 +420,32 @@ Hecks.bluebook "Hecks" do
       emits SmokeHttpRequested
     end
 
+    # `hecks operation.bootstrap_admin <domain> email=<email> [name=<name>] [role=<role>]`. A
+    # domain whose chapter `provides "membership"` has nobody who may grant access until someone is
+    # granted it. This admits the person and grants them the role the grant command is gated to
+    # (or `role`), as a caller that names that role and binds no `actor_id`: Governance checks that
+    # caller by the role it states, which is how the first grant gets made (ADR 0025). It is
+    # refused once anyone holds the administrator role (`Admin`, or `Owner`), and the domain's
+    # persistence must be the one the service runs on (`DATABASE_URL`), not Memory.
+    command "BootstrapAdmin" do
+      role "Operator"
+      goal "Admit the first administrator of a domain's membership chapter and grant them access"
+
+      attribute :run,     OperationKey
+      attribute :subject, Subject
+      attribute :email,   Email
+      attribute :name,    PersonName, optional: true
+      attribute :role,    RoleName,   optional: true
+
+      sets :run
+      sets :subject
+      sets :email
+      sets :name
+      sets :role
+
+      emits AdminBootstrapRequested
+    end
+
     command "Succeed" do
       role "System"
       goal "Record that the operation ended well, and what it reported"
@@ -494,6 +536,11 @@ Hecks.bluebook "Hecks" do
     trigger Operation::DomainRuntime::Smoke, with: { run: :run }
   end
 
+  policy "BootstrapWhenRequested" do
+    on      "Operation.AdminBootstrapRequested"
+    trigger Operation::DomainRuntime::Bootstrap, with: { run: :run }
+  end
+
   policy "OpenWhenRequested" do
     on      "Operation.ConsoleRequested"
     trigger Operation::Terminal::Open, with: { run: :run }
@@ -1173,6 +1220,11 @@ policy "RecordTheEra" do
       attribute :value, String
     end
 
+    # An answer that is one document of text, exactly as the tool that produced it wrote it.
+    value_object "Document" do
+      attribute :text, String
+    end
+
     lifecycle :status, default: "requested" do
       transition "Revendor" => "requested", from: %w[vendored refused]
       transition "Complete" => "vendored",  from: "requested"
@@ -1248,6 +1300,14 @@ policy "RecordTheEra" do
       where(status: "refused")
       order_by :package
     end
+
+    # `hecks package.verify [root=path]`: a read of the files, so it keeps no record. The manifest
+    # is the answer; a package that disagrees with its lock refuses it, naming each one.
+    query "Verify" do
+      description "Check every vendored package against its bluebook.lock, then describe them as the manifest a client image carries."
+      attribute :root, Location, optional: true
+      returns Document
+    end
   end
 
   policy "PinWhenVendored" do
@@ -1270,6 +1330,125 @@ policy "RecordTheEra" do
     trigger Package::Abandon, with: { refusal: :refusal }
   end
 
+  aggregate "Registry" do
+    description "A bluebook registry repository: packages versioned in it and released as tags."
+
+    attribute :run,     RegistryKey
+    attribute :package, PackageName, optional: true
+    attribute :root,    Location,    optional: true
+    attribute :report,  Report,      optional: true
+    attribute :refusal, Report,      optional: true
+    identified_by :run
+
+    value_object "RegistryKey" do
+      attribute :value, String, pattern: '[^ \t\n\r]'
+
+      invariant("a release is named") { !value.to_s.empty? }
+    end
+
+    value_object "PackageName" do
+      attribute :value, String, pattern: '^[a-z][a-z0-9_]*$'
+    end
+
+    # The registry repository: the current directory when absent.
+    value_object "Location" do
+      attribute :value, String, pattern: '[^\t\n\r]'
+    end
+
+    value_object "Report" do
+      attribute :value, String
+    end
+
+    # An answer that is one document of text, exactly as the tool that produced it wrote it.
+    value_object "Document" do
+      attribute :text, String
+    end
+
+    lifecycle :status, default: "requested" do
+      transition "Complete" => "tagged",  from: "requested"
+      transition "Abandon"  => "refused", from: "requested"
+    end
+
+    # `hecks package.release <package> [root=path]`. Tags the package's current version as
+    # `<package>-vX.Y.Z` in the local repository and never pushes; the report ends in the command
+    # that does. A refusal says which rule the package broke.
+    command "Release" do
+      role "Operator"
+      goal "Tag a package of this registry at the version its bluebook.yml carries"
+
+      attribute :run,     RegistryKey
+      attribute :package, PackageName
+      attribute :root,    Location, optional: true
+
+      sets :run
+      sets :package
+      sets :root
+
+      emits ReleaseRequested
+    end
+
+    command "Complete" do
+      role "System"
+      goal "Record that the release was tagged, and the command that publishes it"
+
+      reference_to Registry
+      attribute :report, Report
+
+      sets :report
+
+      emits ReleaseRecorded
+    end
+
+    command "Abandon" do
+      role "System"
+      goal "Record that the release was refused, and why"
+
+      reference_to Registry
+      attribute :refusal, Report
+
+      sets :refusal
+
+      emits ReleaseAbandoned
+    end
+
+    # `hecks package.check [root=path]`: a read of the repository's files and tags, so it keeps no
+    # record. A package that changed since its latest release without a version bump and a changelog
+    # entry refuses it, naming each one.
+    query "Check" do
+      description "Judge every package against its latest release: a changed package needs a newer version and a changelog entry."
+      attribute :root, Location, optional: true
+      returns Document
+    end
+
+    query "Releasing" do
+      description "What releasing one run did: its status, and the report or the refusal."
+      attribute :run, RegistryKey
+      where(run: :run)
+      order_by :run
+    end
+
+    query "Refused" do
+      description "Every release that was refused."
+      where(status: "refused")
+      order_by :run
+    end
+  end
+
+  policy "TagWhenReleased" do
+    on      "Registry.ReleaseRequested"
+    trigger Registry::Git::Tag, with: { run: :run }
+  end
+
+  policy "RecordTheTag" do
+    on      "Registry.ReleaseTagged"
+    trigger Registry::Complete, with: { report: :report }
+  end
+
+  policy "RecordTheRefusedTag" do
+    on      "Registry.ReleaseRefused"
+    trigger Registry::Abandon, with: { refusal: :refusal }
+  end
+
   # A run record for opening a door onto the framework, not a door: the doors live in `Hecks::Doors`.
   aggregate "Door" do
     description "A way into the framework opened for a project: its launchers, or an MCP server."
@@ -1481,6 +1660,8 @@ policy "RecordTheEra" do
     attribute :domain,   DomainPath, optional: true
     attribute :script,   ScriptPath, optional: true
     attribute :artifact, Artifact,   optional: true
+    attribute :target,   TargetTriple, optional: true
+    attribute :stage_dir, StagePath, optional: true
     attribute :seeds,    Count,      optional: true
     attribute :steps,    Count,      optional: true
     attribute :output,   Report,     optional: true
@@ -1515,6 +1696,17 @@ policy "RecordTheEra" do
       attribute :value, String, pattern: '[^ \t\n\r]'
     end
 
+    # A Rust target triple: `<arch>-<vendor>-<os>` with an optional `-<env>`. The toolchain
+    # refuses the triples a host cannot be built for (a wasm target) and the ones not installed.
+    value_object "TargetTriple" do
+      attribute :value, String, pattern: '^[a-z0-9_]+(-[a-z0-9_.]+){2,3}$'
+    end
+
+    # The directory a host build stages its files in.
+    value_object "StagePath" do
+      attribute :value, String, pattern: '[^\t\n\r]'
+    end
+
     value_object "Count" do
       attribute :value, Integer
 
@@ -1563,6 +1755,26 @@ policy "RecordTheEra" do
       emits WasmBuildRequested
     end
 
+    # Compiles the host binary from the installed gem's workspace for the target and stages it with
+    # the domain's `.wasm` and `.ir.json` (in `.hecks/host/<target>/` unless `stage_dir` names a
+    # directory), the files a container image copies in.
+    command "BuildHost" do
+      role "Operator"
+      goal "Build the Rust host for a domain, with its wasm and IR, ready to copy into an image"
+
+      attribute :domain, DomainPath
+      attribute :run,    BuildKey
+      attribute :target, TargetTriple, optional: true
+      attribute :stage_dir, StagePath, optional: true
+
+      sets :domain
+      sets :run
+      sets :target
+      sets :stage_dir
+
+      emits HostBuildRequested
+    end
+
     command "BuildBrowserWasm" do
       role "Operator"
       goal "Compile a domain to an ES module a browser can import"
@@ -1685,6 +1897,11 @@ policy "RecordTheEra" do
     trigger Build::RustToolchain::Wasm, with: { run: :run }
   end
 
+  policy "BuildHostWhenRequested" do
+    on      "Build.HostBuildRequested"
+    trigger Build::RustToolchain::Host, with: { run: :run }
+  end
+
   policy "CompileBrowserWasmWhenRequested" do
     on      "Build.BrowserWasmBuildRequested"
     trigger Build::RustToolchain::BrowserWasm, with: { run: :run }

data/lib/hecks/hecks/hecks.hecksagon

@@ -43,6 +43,12 @@ Hecks.hecksagon "Hecks" do
       refuses "OperationRefused"
     end
 
+    asks "Bootstrap", to: Operation do
+      attribute :run, OperationKey
+      answers "OperationAnswered"
+      refuses "OperationRefused"
+    end
+
     answers_query "Follow"
   end
 
@@ -87,6 +93,18 @@ Hecks.hecksagon "Hecks" do
       answers "PackagePinned"
       refuses "PinRefused"
     end
+
+    answers_query "Verify"
+  end
+
+  Hecks::Registry.port "Git" do
+    asks "Tag", to: Registry do
+      attribute :run, RegistryKey
+      answers "ReleaseTagged"
+      refuses "ReleaseRefused"
+    end
+
+    answers_query "Check"
   end
 
   Hecks::Door.port "Workspace" do
@@ -130,6 +148,12 @@ Hecks.hecksagon "Hecks" do
       refuses "BuildRefused"
     end
 
+    asks "Host", to: Build do
+      attribute :run, BuildKey
+      answers "BuildAnswered"
+      refuses "BuildRefused"
+    end
+
     asks "BrowserWasm", to: Build do
       attribute :run, BuildKey
       answers "BuildAnswered"

data/lib/hecks/hecks/hecks.world

@@ -25,8 +25,10 @@
 # `Doors::LauncherOptions`): `run_keys` mints a `run` key for a creating command given none,
 # `failure_states` are the lifecycle states `--wait` reports as exit 1 (every failure state the
 # chapter's lifecycles declare), `names` gives a command the launcher name clients type,
-# `executable` is where `hecks project_cli` writes this chapter's launcher (the gem's
-# `exe/hecks`), `streams` lists the questions `--stream` may tail (`Follow`), `memory_commands` names
+# `settled` names the commands that always wait for their reactions, as if `--wait` were given, so a
+# refusal is an exit status and a reason on standard error (`package.vendor`, which a script runs
+# for its outcome), `executable` is where `hecks project_cli` writes this chapter's launcher (the
+# gem's `exe/hecks`), `streams` lists the questions `--stream` may tail (`Follow`), `memory_commands` names
 # the commands that launcher runs on the Memory environment unless `HECKS_ENVIRONMENT` is set (so
 # `hecks console` needs no database), and `legacy` names the commands it hands to `Hecks::CLI` in the
 # positional forms ADR 0066 shipped.
@@ -37,8 +39,11 @@ Hecks.world "Hecks" do
   launcher "Launcher", run_keys: true,
                        failure_states: %w[flagged failed drifted unreachable refused faulted halted stopped
                                           abandoned red needs_fix],
+                       settled: %w[package.vendor package.revendor package.release
+                                  operation.bootstrap_admin],
                        names: { "mcp" => "door.serve_mcp", "console" => "operation.open_console", "init" => "door.init",
-                                "interview" => "door.interview" },
+                                "interview" => "door.interview", "package.check" => "registry.check",
+                                "package.release" => "registry.release" },
                        streams: %w[Follow],
                        executable: "exe/hecks",
                        memory_commands: %w[console init interview],

data/lib/hecks/hecks/site.world

@@ -3,8 +3,11 @@
 # here: hecks.world's `default_adapter` fills the gap, so the memory overlay swaps it with the rest.
 #
 # `run_keys` mints the `run` key of a projection, and `--wait` reports a faulted projection (a
-# routes.ts out of date under `--check`, or a route table the projector refused) as exit 1.
+# routes.ts out of date under `--check`, or a route table the projector refused) as exit 1, and
+# `settled` makes `site_projection.check_live` wait for its reactions without the flag, so a live
+# distribution that differs from the project is an exit status.
 Hecks.world "Site" do
   launcher "Launcher", run_keys: true,
-                       failure_states: %w[faulted refused halted stopped abandoned red needs_fix]
+                       failure_states: %w[faulted refused halted stopped abandoned red needs_fix],
+                       settled: %w[site_projection.check_live]
 end