hecks 3.7.0 → 3.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b528b48266e3984df1fa1d14210984272471586c775cf95487c883edc5552c0
-  data.tar.gz: dae0ec3b22400a3d8dc8764228ffce3d3e845dc833204dc26c70eac221b78fc4
+  metadata.gz: d303c552c29899c933f31445d71ea42063a1b7cc5233cdef4a1d7392aa10201c
+  data.tar.gz: caa19c0f1639d2ca386465977a1c099336ee2c1e598399ee3b88122206d3c2b7
 SHA512:
-  metadata.gz: 1f42899b69da5c2ff3a5dd7b10b1dfbe75623725b739111f4004f28d3a651a151f8d56abdafc71cbcbcda17de05d6f474b59e6bfe7f9c7726f0047018fbe83e3
-  data.tar.gz: 870a7b4c6c636b3a0dd1ab16773c55da1effc9ed6e51f3a0bfc5721cea3b0b9ff237d721f98227d95b253f7c714d1499a34740c476e17f9cda609902e1db6a13
+  metadata.gz: 3b2ee56f395214eee7e018c8ba28650b8f5f9ec97cc683b705037e19e37c96246fa4a380bbedb2aec9189ccb0361f3ef5f32e7af07cd5808531c1891e6e3011c
+  data.tar.gz: deb31a80d9d10f30898074608b3158e2e916989160d69cb632777c14dae4305dd2fe43d5da8561024625c0e24175fab7fc7998469854e00f16561ef1e2dd59cf

data/lib/hecks/bluebook/meta_validator/modes.rb

@@ -118,6 +118,20 @@ module Hecks
           @shadow_parsing = previous
         end
 
+        # Wraps `block` with `shadow_parsing?` false, restoring it afterward. The language's own
+        # grammar is built once per process and memoized, so it cannot take the mode of whichever
+        # caller happens to ask for it first.
+        #
+        # @yield the one-time grammar build, with `shadow_parsing?` false throughout
+        # @return [Object] the block's own return value
+        def while_not_shadow_parsing
+          previous        = @shadow_parsing
+          @shadow_parsing = false
+          yield
+        ensure
+          @shadow_parsing = previous
+        end
+
         # Wraps `block` with `disabled?` forced false, restoring it afterward.
         # Only `grammar_registry`'s one-time fixpoint build uses this.
         #

data/lib/hecks/bluebook/meta_validator.rb

@@ -168,12 +168,14 @@ module Hecks
       end
 
       # The booted, self-judged language registry every ordinary bluebook is
-      # judged against — built once per process and memoized.
+      # judged against — built once per process and memoized, with shadow parsing off: a caller
+      # inside `while_shadow_parsing` that is first to ask would otherwise memoize a grammar
+      # parsed in that mode, or fail to load it.
       #
       # @return [Runtime::Registry] the booted, fixpoint-judged language
       #   registry
       def self.grammar_registry
-        @grammar_registry ||= begin
+        @grammar_registry ||= while_not_shadow_parsing do
           registry = load_grammar_into(Runtime::Registry.new)
           # Assigned before the fixpoint judge below, since judging re-enters
           # grammar_registry (via fresh_runtime/Plan.for) and a bare `||=`

data/lib/hecks/corpus/routes.rb

@@ -27,7 +27,7 @@ module Hecks
       # hecks fuzz sweeps it too, once Fuzzing::Replay coerces value-object args
       # before recomputing givens — today it doesn't, so this given reads as
       # wrongly admitted.
-      Route.new(%r{\Aspec/fixtures/rust_host/}, :named_in, "rust/host/src/web.rs", "checkout_fixture",
+      Route.new(%r{\Aspec/fixtures/rust_host/}, :named_in, "rust/host/src/web/commerce.rs", "checkout_fixture",
                 "the Rust host's checkout fixture, pinned by its web and /api tests")
     ].freeze
   end

data/lib/hecks/gate/stages.yml

@@ -25,7 +25,17 @@ pre_push:
   checks:
     - id: rspec
       title: rspec (parallel)
-      run: [bundle, exec, parallel_rspec, spec, -n, "{workers}"]
+      run:
+        - sh
+        - -ec
+        - |
+          # Workers are grouped by this machine's own last timings, kept under the git directory
+          # (shared by every worktree, never committed). CI's committed baseline leaves out the io
+          # specs this run includes, so it only seeds the first run; each run then rewrites the log.
+          log="$(git rev-parse --git-common-dir)/hecks_rspec_runtime.log"
+          [ -f "$log" ] || cp .github/rspec_runtime_baseline.log "$log"
+          bundle exec parallel_rspec spec -n {workers} --group-by runtime --runtime-log "$log" --allowed-missing 100 \
+            -o "--format ParallelTests::RSpec::RuntimeLogger --out $log"
       blocked: the suite is red.
     - &check_fuzzing
       id: fuzzing

data/lib/hecks/hecks/adapters/site_toolchain/prober.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "openssl"
+require_relative "../../../projections/site/probe"
+
+module Hecks
+  module Adapters
+    class SiteToolchain
+      # Sends a route table's probe requests to a running site and reports each answer.
+      #
+      # Every request is anonymous and follows no redirect, so a probe changes nothing on the site.
+      class Prober
+        # Seconds to wait to connect to the site, and again for its answer.
+        TIMEOUT = 10
+
+        # The failures of the network that fail one check rather than the whole run.
+        NETWORK = [SystemCallError, Timeout::Error, SocketError, OpenSSL::SSL::SSLError].freeze
+
+        # @param rows [Array<Projections::Site::Table::Row>] the checked rows of the route table
+        # @param run [String] the run's name
+        # @param base [String] the site's scheme, host and port
+        def initialize(rows, run:, base:)
+          @probe = Projections::Site::Probe.new(rows, run: run)
+          @base = base
+        end
+
+        # @return [Array<(String, Integer)>] the report, one line per check ending in the count,
+        #   and how many checks failed
+        def call
+          lines = @probe.checks.map { |check| judged(check) }
+          failed = lines.count { |_, wrong| wrong }
+          [lines.map(&:first).append("#{lines.size} checks, #{failed} failed").join("\n"), failed]
+        end
+
+        private
+
+        # One check's line of the report: its label and `ok`, or the reason it failed.
+        def judged(check)
+          why = @probe.verdict(check, answer_to(check))
+          ["  #{check.label}... #{why ? "FAILED: #{why}" : "ok"}", !why.nil?]
+        rescue *NETWORK => e
+          ["  #{check.label}... FAILED: #{e.class}: #{e.message}", true]
+        end
+
+        def answer_to(check)
+          uri = URI.join(@base, check.path)
+          request = Net::HTTP.const_get(check.verb.capitalize).new(uri)
+          request["Origin"] = @base
+          response = connection(uri).request(request)
+          Projections::Site::Probe::Response.new(status: response.code.to_i, body: response.body,
+                                                 headers: response.to_hash.transform_values(&:first))
+        end
+
+        def connection(uri)
+          Net::HTTP.new(uri.host, uri.port).tap do |http|
+            http.use_ssl = uri.scheme == "https"
+            http.open_timeout = http.read_timeout = TIMEOUT
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/hecks/adapters/site_toolchain.rb

@@ -8,6 +8,7 @@ require_relative "codebase/ruby_child"
 require "hecks/tools"
 require "hecks/tools/site_routes"
 require "hecks/projections/site/live_edge"
+require_relative "site_toolchain/prober"
 
 module Hecks
   module Adapters
@@ -66,8 +67,35 @@ module Hecks
         { output: { value: comparison.to_s } }
       end
 
+      # Asks a running site what its route table says it must answer, and judges each answer. It
+      # sends anonymous requests only, follows no redirect, and changes nothing on the site: an
+      # admin route is asked without a session and must refuse.
+      #
+      # @param held [Hash] the `SiteProjection` record: `domain`, `run` and `url`, the site's base
+      #   address
+      # @return [Hash{Symbol => Hash}] `output:` one line per check, ending in the count
+      # @raise [ConsoleCapture::Failure] when the address is not http(s) or an answer is wrong; the
+      #   message is the report
+      def probe(**held)
+        rows = table_of(located(:domain, held[:domain])).rows
+        report, failed = Prober.new(rows, run: plain(held[:run]).to_s, base: base_url(plain(held[:url]))).call
+        raise ConsoleCapture::Failure, report if failed.positive?
+
+        { output: { value: report } }
+      end
+
       private
 
+      # The scheme, host and port of an http(s) address.
+      def base_url(url)
+        uri = URI.parse(url.to_s)
+        raise URI::InvalidURIError unless uri.is_a?(URI::HTTP) && uri.host
+
+        "#{uri.scheme}://#{uri.host}#{":#{uri.port}" unless uri.port == uri.default_port}"
+      rescue URI::InvalidURIError
+        raise ConsoleCapture::Failure, "url must be an http(s) address, got #{url.inspect}"
+      end
+
       # The flags `project_site` is run with: each the record names, and `--check` when asked.
       def project_flags(held)
         flags = FLAGS.filter_map { |flag, key| "--#{flag}=#{located(key, held[key])}" unless plain(held[key]).nil? }
@@ -84,15 +112,23 @@ module Hecks
 
       # The project's checked edge, read the way `project_site` reads it.
       def edge_of(root, template = nil)
+        registry, chapter, table = read_table(root)
+        site = Projections::Site
+        site::Edge.read(chapter, table: table, template: template, vocabulary: site::Table.vocabulary(registry)) ||
+          raise(ConsoleCapture::Failure, "#{root} declares no Edge rows")
+      end
+
+      # The project's checked route table.
+      def table_of(root) = read_table(root).last
+
+      # The registry, chapter and checked table of the project at `root`.
+      def read_table(root)
         registry = nil
         outcome = ConsoleCapture.capture { registry = Tools::SiteRoutes.registry_for(root) }
         raise ConsoleCapture::Failure, outcome.output.strip unless outcome.ok?
 
-        site = Projections::Site
-        chapter = site::Table.chapter(registry)
-        table = site::Table.read(chapter, registry: registry)
-        site::Edge.read(chapter, table: table, template: template, vocabulary: site::Table.vocabulary(registry)) ||
-          raise(ConsoleCapture::Failure, "#{root} declares no Edge rows")
+        chapter = Projections::Site::Table.chapter(registry)
+        [registry, chapter, Projections::Site::Table.read(chapter, registry: registry)]
       rescue Projections::Site::Table::Invalid => e
         raise ConsoleCapture::Failure, e.message
       end

data/lib/hecks/language/bluebook/vocabulary.bluebook

@@ -626,7 +626,7 @@ Hecks.bluebook "Bluebook" do
              label: "does this change touch lib/hecks/runtime/**?"
       member name: "postgres_io_relevant_changed", workflow: "ci-postgres-io-parallel.yml", mode: "skips_unless",
              pattern: '^(docs/|editors/|release/|deploy/|\.claude/|\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests)/|\.rubocop\.yml$|\.rubocop_todo\.yml$|\.mcp\.json$|\.rspec-local\.example$|README\.md$|CHANGELOG\.md$|CONTRIBUTING\.md$|SECURITY\.md$|LICENSE$|\.gitignore$)',
-             push: "before_sha",
+             push: "skip",
              label: "does this change touch anything rspec_postgres_io_parallel covers?"
     end
 

data/lib/hecks/projections/deploy/shared_database_instance/templates/rds.yaml.tmpl

@@ -58,7 +58,7 @@ Resources:
   DbSecurityGroup:
     Type: AWS::EC2::SecurityGroup
     Properties:
-      GroupDescription: @@STACK@@ RDS, 5432 from each site's box (their stacks add the rules) and a bastion if given
+      GroupDescription: @@STACK@@ RDS, 5432 from each site box (the box stacks add the rules) and a bastion if given
       VpcId: !Ref VpcId
 
   BastionIngress:

data/lib/hecks/projections/deploy/templates/lambda/template.yaml.tmpl

@@ -126,7 +126,7 @@ Resources:
           # triggers that first boot; a LATER real schema evolution
           # (era 2+) is a separate, later re-generation, not this one.
           HECKS_DOMAIN: @@declared_domain_name@@
-          # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/main.rs`'s
+          # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/boot.rs`'s
           # own boot sequence reads `ir::ir().ok_or(...)?` for every domain
           # regardless of web mode (era-lineage bookkeeping needs the IR, not
           # just the optional in-process web UI), so a Shared-mode domain with

data/lib/hecks/projections/site/probe.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      # The requests a live site must answer as its route table says, and the verdict on each
+      # answer. It sends nothing: the caller makes the requests and hands each response back.
+      # A route with a parameter or a prefix (`/blog/:slug.html`, `/auth/*`) has no one URL to ask.
+      #
+      # - an `admin` route refuses an anonymous GET (and POST, where it takes one), uncached
+      # - an indexable `public` page answers 200 and names its canonical link
+      # - a row that is `off` answers 404, and a `redirect` row redirects to `redirect_to`
+      # - a path no row declares answers 404
+      class Probe
+        # One request to make and what a good answer to it looks like.
+        #
+        # @!attribute [r] label
+        #   @return [String] what is being checked, for the report
+        # @!attribute [r] verb
+        #   @return [String] GET or POST
+        # @!attribute [r] path
+        #   @return [String] the path to ask
+        # @!attribute [r] expect
+        #   @return [Symbol] one of `:refused`, `:page`, `:missing`, `:redirect`
+        # @!attribute [r] to
+        #   @return [String, nil] where a `:redirect` must lead
+        Check = Struct.new(:label, :verb, :path, :expect, :to, keyword_init: true)
+
+        # What one answer was: its status, its headers (lower-case names) and its body.
+        Response = Struct.new(:status, :headers, :body, keyword_init: true)
+
+        # The statuses that turn an anonymous caller away from an admin route.
+        REFUSED = [301, 302, 303, 307, 308, 401, 403].freeze
+
+        # The redirect statuses.
+        REDIRECTS = [301, 302, 303, 307, 308].freeze
+
+        # @param rows [Array<Table::Row>] the checked rows of a route table
+        # @param run [String] the run's name, which makes the missing path unique to it
+        def initialize(rows, run:)
+          @rows = rows
+          @run = run
+        end
+
+        # @return [Array<Check>] every request worth making, in the table's order, then the
+        #   path that must not exist
+        def checks
+          @rows.select { |row| askable?(row) }.flat_map { |row| for_row(row) } + [missing]
+        end
+
+        # Judges one answer.
+        #
+        # @param check [Check] the request that was made
+        # @param response [Response] what came back
+        # @return [String, nil] why the answer is wrong, or nil when it is right
+        def verdict(check, response)
+          case check.expect
+          when :refused  then refused(response)
+          when :page     then page(response)
+          when :missing  then response.status == 404 ? nil : "expected 404, got HTTP #{response.status}"
+          when :redirect then redirect(check, response)
+          end
+        end
+
+        private
+
+        def askable?(row) = !row.path.empty? && !row.path.match?(/[:*]/)
+
+        def for_row(row)
+          return [off(row)] if row.off
+          return admin(row) if row.auth == "admin"
+          return [redirecting(row)] if row.kind == "redirect" && row.redirect_to
+          return [page_of(row)] if page?(row)
+
+          []
+        end
+
+        def page?(row) = row.auth == "public" && row.kind == "page" && row.indexable && row.verbs.include?("GET")
+
+        def off(row) = Check.new(label: "#{row.path} is switched off: 404", verb: "GET", path: row.path, expect: :missing)
+
+        def admin(row)
+          row.verbs.select { |verb| %w[GET POST].include?(verb) }.map do |verb|
+            Check.new(label: "#{verb} #{row.path} without a session is refused and not cached",
+                      verb: verb, path: row.path, expect: :refused)
+          end
+        end
+
+        def redirecting(row)
+          Check.new(label: "#{row.path} redirects to #{row.redirect_to}", verb: "GET", path: row.path,
+                    expect: :redirect, to: row.redirect_to)
+        end
+
+        def page_of(row)
+          Check.new(label: "#{row.path} answers 200 with a canonical link", verb: "GET", path: row.path, expect: :page)
+        end
+
+        def missing
+          Check.new(label: "a path no row declares is a real 404", verb: "GET", path: "/probe-#{@run}-missing",
+                    expect: :missing)
+        end
+
+        def refused(response)
+          return "expected a redirect, 401 or 403, got HTTP #{response.status}" unless REFUSED.include?(response.status)
+          return nil if response.status >= 400
+
+          control = response.headers["cache-control"].to_s
+          return nil unless control.match?(/public|max-age=[1-9]/) && !control.match?(/no-store|private/)
+
+          "the redirect is cacheable (Cache-Control: #{control})"
+        end
+
+        def page(response)
+          return "expected 200, got HTTP #{response.status}" unless response.status == 200
+          return nil if response.body.to_s.match?(/<link[^>]+rel=["']canonical["']/i)
+
+          "the page has no canonical link"
+        end
+
+        def redirect(check, response)
+          return "expected a redirect, got HTTP #{response.status}" unless REDIRECTS.include?(response.status)
+
+          location = response.headers["location"].to_s
+          return nil if location == check.to || (location.end_with?(check.to) && location.start_with?("http"))
+
+          "redirects to #{location.inspect}, expected #{check.to.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_host/dockerfile.rb

@@ -52,7 +52,7 @@ module Hecks
 
             COPY deploy-aws/boot.mjs ./
             # RDS enforces TLS; boot.mjs verifies against Amazon's CA bundle.
-            ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
+            ADD --chmod=0644 https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
 
             # boot.mjs sits outside the Next app, so `next build` does not trace its import of the AWS SDK.
             COPY --from=build /app/node_modules/@aws-sdk ./node_modules/@aws-sdk

data/lib/hecks/runtime/value/validation.rb

@@ -88,8 +88,8 @@ module Hecks
         def normalize_composite_field(aggregate, attribute, fields)
           # A list member hydrates the same as a top-level list, so a value
           # read back from the store matches the shape a live dispatch wrote.
-          # Load door only — an input list member is left as offered.
-          return hydrate_stored_list(aggregate, attribute, fields) if attribute.list?
+          # An input list member is validated as offered and left as offered.
+          return normalize_list(aggregate, attribute, fields) if attribute.list?
 
           raw = fields[attribute.name]
           return if raw.nil? || raw.is_a?(self)
@@ -103,15 +103,46 @@ module Hecks
           fields[attribute.name] = nested_fields
         end
 
+        def normalize_list(aggregate, attribute, fields)
+          return hydrate_stored_list(aggregate, attribute, fields) if trusting_stored_state?
+
+          validate_input_list(aggregate, attribute, fields)
+        end
+
+        # Runs each value-object member of an input list through the same door a nested single
+        # value goes through, so a member's own invariants and nested lists refuse on dispatch
+        # exactly as they do when the list sits directly on a command. The members stay as offered.
+        def validate_input_list(aggregate, attribute, fields)
+          nested = value_object_for(aggregate, attribute.type)
+          return unless nested
+
+          Array(fields[attribute.name]).each do |member|
+            next unless member.is_a?(Hash)
+
+            member_fields = apply_defaults(nested, fields_for(nested, attribute.name, member))
+            validate!(nested, normalize_composite_fields(aggregate, nested, member_fields))
+          end
+        end
+
         def hydrate_stored_list(aggregate, attribute, fields)
           return unless trusting_stored_state?
 
           fields[attribute.name] = for_attribute(aggregate, attribute, fields[attribute.name])
         end
 
+        # An optional attribute the caller left out reads as nil in an invariant, so a rule can
+        # ask `x.nil?` or `x.set?` of it instead of failing to resolve a key that was never sent.
+        def with_absent_optionals(value_object, fields)
+          absent = value_object.attributes.select { |attribute| attribute.optional? && !fields.key?(attribute.name) }
+          return fields if absent.empty?
+
+          absent.to_h { |attribute| [attribute.name, nil] }.merge(fields)
+        end
+
         def check_invariants(value_object, fields)
+          known = with_absent_optionals(value_object, fields)
           value_object.invariants.each do |invariant|
-            next if Bluebook::Expression::Evaluator.call_rule(invariant, fields)
+            next if Bluebook::Expression::Evaluator.call_rule(invariant, known)
 
             raise InvariantViolation,
                   RefusalWording.render_site("InvariantViolation", "value_object_invariant",

data/lib/hecks/site/bluebook/site.bluebook

@@ -107,6 +107,7 @@ Hecks.bluebook "Site" do
     attribute :distribution, DistributionId, optional: true
     attribute :expect_new, PathList, optional: true
     attribute :refs,      PolicyRefs, optional: true
+    attribute :url,       SiteUrl,   optional: true
     attribute :output,    Report,    optional: true
     attribute :refusal,   Report,    optional: true
     identified_by :run
@@ -155,6 +156,11 @@ Hecks.bluebook "Site" do
       attribute :value, String, pattern: '[^\t\n\r]'
     end
 
+    # A running site's address, `https://example.org`: what `check_site` sends its requests to.
+    value_object "SiteUrl" do
+      attribute :value, String, pattern: '^https?://[^ \t\n\r]+$'
+    end
+
     value_object "Report" do
       attribute :value, String
     end
@@ -224,6 +230,26 @@ Hecks.bluebook "Site" do
       emits "LiveCheckRequested"
     end
 
+    # `hecks site site_projection.check_site <project> url=<https://example.org>`. Asks a running
+    # site what its route table says it must answer, with anonymous requests that follow no
+    # redirect and change nothing: an admin route refuses, an indexable public page answers 200
+    # with a canonical link, an `off` row and an undeclared path answer 404, and a redirect row
+    # redirects to its target. Routes that name a parameter or a prefix are left out. It prints a
+    # line per check and exits 1 when any answer is wrong.
+    command "CheckSite" do
+      goal "Ask a running site what its route table says it must answer, and judge each answer"
+
+      attribute :domain, DomainPath
+      attribute :run,    RunKey
+      attribute :url,    SiteUrl
+
+      sets :domain
+      sets :run
+      sets :url
+
+      emits "SiteProbeRequested"
+    end
+
     command "Complete" do
       goal "Record that routes.ts was written, or found current, or the live edge matched, and what it said"
 
@@ -270,6 +296,11 @@ Hecks.bluebook "Site" do
     trigger SiteProjection::SiteToolchain::Compare, with: { run: :run }
   end
 
+  policy "ProbeWhenRequested" do
+    on      "SiteProjection.SiteProbeRequested"
+    trigger SiteProjection::SiteToolchain::Probe, with: { run: :run }
+  end
+
   policy "RecordTheProjection" do
     on      "SiteProjection.SiteAnswered"
     trigger SiteProjection::Complete, with: { output: :output }

data/lib/hecks/site/bluebook/site.ports.hecksagon

@@ -17,5 +17,11 @@ Hecks.hecksagon "Site" do
       answers "SiteAnswered"
       refuses "SiteRefused"
     end
+
+    asks "Probe", to: SiteProjection do
+      attribute :run, RunKey
+      answers "SiteAnswered"
+      refuses "SiteRefused"
+    end
   end
 end

data/lib/hecks/version.rb

@@ -1,5 +1,5 @@
 module Hecks
   # Read directly by the gemspec, so this file must never require the
   # rest of the gem (its dependencies aren't resolved yet at that point).
-  VERSION = "3.7.0".freeze
+  VERSION = "3.9.1".freeze
 end

data/lib/hecks/vocabulary.rb

@@ -51,7 +51,7 @@ module Hecks
       ].freeze,
       "CiGate" => [
         {"name"=>"runtime_changed", "workflow"=>"ci.yml", "mode"=>"touches", "pattern"=>"^lib/hecks/runtime/", "push"=>"before_sha", "label"=>"does this change touch lib/hecks/runtime/**?"}.freeze,
-        {"name"=>"postgres_io_relevant_changed", "workflow"=>"ci-postgres-io-parallel.yml", "mode"=>"skips_unless", "pattern"=>"^(docs/|editors/|release/|deploy/|\\.claude/|\\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests)/|\\.rubocop\\.yml$|\\.rubocop_todo\\.yml$|\\.mcp\\.json$|\\.rspec-local\\.example$|README\\.md$|CHANGELOG\\.md$|CONTRIBUTING\\.md$|SECURITY\\.md$|LICENSE$|\\.gitignore$)", "push"=>"before_sha", "label"=>"does this change touch anything rspec_postgres_io_parallel covers?"}.freeze
+        {"name"=>"postgres_io_relevant_changed", "workflow"=>"ci-postgres-io-parallel.yml", "mode"=>"skips_unless", "pattern"=>"^(docs/|editors/|release/|deploy/|\\.claude/|\\.githooks/|rust/(parser|codegen|host|build|lsp|web|tests)/|\\.rubocop\\.yml$|\\.rubocop_todo\\.yml$|\\.mcp\\.json$|\\.rspec-local\\.example$|README\\.md$|CHANGELOG\\.md$|CONTRIBUTING\\.md$|SECURITY\\.md$|LICENSE$|\\.gitignore$)", "push"=>"skip", "label"=>"does this change touch anything rspec_postgres_io_parallel covers?"}.freeze
       ].freeze,
       "Comparison" => [
         {"symbol"=>">=", "compares_less_than"=>"true", "compares_equal"=>"false", "negated"=>"true"}.freeze,