hecks 3.9.1 → 3.11.0

data/lib/hecks/runtime/saga_interpreter.rb

@@ -55,11 +55,11 @@ module Hecks
 
       # @param registry [Runtime::Registry] the booted registry whose declared
       #   process managers and saga persistence this interpreter runs against
-      # @param door [Runtime::Dispatcher] the dispatcher a saga leg's own dispatch
+      # @param dispatcher [Runtime::Dispatcher] the dispatcher a saga leg's own dispatch
       #   re-enters through
-      def initialize(registry, door:)
+      def initialize(registry, dispatcher:)
         @registry = registry
-        @door     = door
+        @dispatcher = dispatcher
       end
 
       # Runs `domain`'s declared process managers against `event`: begins,

data/lib/hecks/runtime/tenant_check.rb

@@ -1,4 +1,5 @@
 require_relative "../ports/persistence/binding_policy"
+require_relative "best_effort"
 
 module Hecks
   module Runtime
@@ -37,10 +38,10 @@ module Hecks
       # Same defensive shape as EraCheck#lineage_capable? — a class that
       # doesn't respond at all, or whose lookup raises, is false, not an error.
       def tenant_capable?(registry, adapter_name)
-        adapter_class = registry.adapters[adapter_name] && registry.adapter_class(adapter_name)
-        adapter_class.respond_to?(:tenant_capable?) && adapter_class.tenant_capable?
-      rescue StandardError
-        false
+        BestEffort.call(false) do
+          adapter_class = registry.adapters[adapter_name] && registry.adapter_class(adapter_name)
+          adapter_class.respond_to?(:tenant_capable?) && adapter_class.tenant_capable?
+        end
       end
     end
   end

data/lib/hecks/runtime/value/coercion.rb

@@ -37,9 +37,9 @@ module Hecks
         # Coerces `value` for a single, already-resolved `attribute`, branching on
         # its declared shape (list, reference, composite, or bare scalar).
         #
-        # `boundary: false` is the query door, where a declared type documents the
+        # `boundary: false` is the query entry point, where a declared type documents the
         # argument for callers/generators rather than naming a shape to enforce.
-        # `argument: true` is the command/entity/port dispatch door, where a nil for
+        # `argument: true` is the command/entity/port dispatch entry point, where a nil for
         # a required attribute is a left-empty argument (C3.7), not ordinary state nil.
         #
         # @raise [Runtime::TypeMismatch] if `value` cannot be coerced, or a required

data/lib/hecks/runtime/value/validation.rb

@@ -34,7 +34,11 @@ module Hecks
           fields
         end
 
-        # Fills every declared attribute `fields` lacks with its own `default:`.
+        # Fills every declared attribute `fields` lacks with its own `default:`, and every required
+        # list it lacks with an empty one: a list left out reads as no members, the one shape the
+        # Rust runtime (a `Vec`) can hold, so a value object built from nothing (a required
+        # argument left empty, C3.7) is `{blocks: []}` on both sides rather than `{}` here.
+        # An optional list stays absent, and an offered list, empty or not, is kept as offered.
         #
         # @param value_object [Class] the `Bluebook::ValueObject` subclass whose
         #   declared defaults are read
@@ -42,11 +46,11 @@ module Hecks
         # @return [Hash{Symbol => Object}] `fields`, with defaults filled in
         def apply_defaults(value_object, fields)
           value_object.attributes.each_with_object(fields) do |attribute, completed|
-            completed[attribute.name] = attribute.default unless completed.key?(attribute.name) || attribute.default.nil?
+            fill_absent(completed, attribute) unless completed.key?(attribute.name)
           end
         end
 
-        # The full door a value object's own fields pass through — shared by
+        # The full entry point a value object's own fields pass through — shared by
         # `build` and `normalize_composite_fields`, so a nested field refuses
         # exactly like the same type declared directly on a command.
         #
@@ -85,6 +89,13 @@ module Hecks
 
         private
 
+        # The default an absent attribute declares, else an empty list for a required list.
+        def fill_absent(fields, attribute)
+          return fields[attribute.name] = attribute.default unless attribute.default.nil?
+
+          fields[attribute.name] = [] if attribute.list? && !attribute.optional?
+        end
+
         def normalize_composite_field(aggregate, attribute, fields)
           # A list member hydrates the same as a top-level list, so a value
           # read back from the store matches the shape a live dispatch wrote.
@@ -109,7 +120,8 @@ module Hecks
           validate_input_list(aggregate, attribute, fields)
         end
 
-        # Runs each value-object member of an input list through the same door a nested single
+        # Runs each value-object member of an input list through the same entry point a nested
+        # single
         # value goes through, so a member's own invariants and nested lists refuse on dispatch
         # exactly as they do when the list sits directly on a command. The members stay as offered.
         def validate_input_list(aggregate, attribute, fields)

data/lib/hecks/runtime.rb

@@ -42,12 +42,12 @@ module Hecks
       #
       # @param path [String] path to a domain directory, or a file inside one
       # @param shared [String, nil] a shared-root override
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @param environment [String, nil] the environment name for `Adapters::Folder#load_domain`
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot(path, shared: nil, install_doors: true, environment: Runtime::Loader::FROM_ENV)
-        Loader.boot(path, shared: shared, install_doors: install_doors, environment: environment)
+      def boot(path, shared: nil, install_driving: true, environment: Runtime::Loader::FROM_ENV)
+        Loader.boot(path, shared: shared, install_driving: install_driving, environment: environment)
       end
 
       # Loads a domain's declarations without binding any adapter. See Loader.describe.
@@ -63,23 +63,23 @@ module Hecks
       # Finishes a boot from declarations `describe` already loaded. See Loader.boot_described.
       #
       # @param described [Runtime::Loader::Described] what `describe` answered
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot_described(described, install_doors: true)
-        Loader.boot_described(described, install_doors: install_doors)
+      def boot_described(described, install_driving: true)
+        Loader.boot_described(described, install_driving: install_driving)
       end
 
       # Loads only the given files of a domain; otherwise like `boot`. See Loader.boot_files.
       #
       # @param paths [String, Array<String>] one or more file paths within the domain
       # @param shared [String, nil] a shared-root override
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @param environment [String, nil] the environment name for the selected-file loader
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot_files(paths, shared: nil, install_doors: true, environment: Runtime::Loader::FROM_ENV)
-        Loader.boot_files(paths, shared: shared, install_doors: install_doors, environment: environment)
+      def boot_files(paths, shared: nil, install_driving: true, environment: Runtime::Loader::FROM_ENV)
+        Loader.boot_files(paths, shared: shared, install_driving: install_driving, environment: environment)
       end
 
       # Bind the ambient registry for the duration of the block, restoring

data/lib/hecks/rust_build/project_rust/target_ir.rb

@@ -11,7 +11,7 @@ module Hecks
         # The optional attachments `rust/host` reads from `ir.json`, each omitted when nothing
         # attached provides it: exporter method, then the key it is written under.
         SEAMS = %i[authorization membership identity newsletter newsletter_issues payments
-                   registrations payment_connection].freeze
+                   registrations payment_connection checkout].freeze
 
         # Round-trips a value through JSON so generators see the string-keyed shape a real
         # `ir.json` carries, never live Ruby symbols.

data/lib/hecks/rust_build/wasm.rb

@@ -60,7 +60,7 @@ module Hecks
       end
 
       def require_target!
-        return if system("rustup target list --installed 2>/dev/null | grep -qx #{TARGET}")
+        return if RustBuild.target_installed?(TARGET)
 
         raise Failure, <<~MSG
           #{TARGET} isn't installed for this toolchain. Install it once with:

data/lib/hecks/rust_build/wasm_browser.rb

@@ -52,7 +52,7 @@ module Hecks
       end
 
       def require_target!
-        return if system("rustup target list --installed 2>/dev/null | grep -qx #{TARGET}")
+        return if RustBuild.target_installed?(TARGET)
 
         raise Failure, <<~MSG
           #{TARGET} isn't installed for this toolchain. Install it once with:

data/lib/hecks/rust_build.rb

@@ -83,6 +83,17 @@ module Hecks
         raise Failure, "`#{command.join(" ")}` failed#{" in #{chdir}" if chdir}"
       end
 
+      # Asks rustup whether a compile target is installed for the active toolchain.
+      #
+      # @param target [String] the target triple, such as `wasm32-unknown-unknown`
+      # @return [Boolean] false when rustup is missing or does not list the target
+      def target_installed?(target)
+        listed = IO.popen(["rustup", "target", "list", "--installed", { err: File::NULL }], &:read)
+        listed.split("\n").include?(target)
+      rescue SystemCallError
+        false
+      end
+
       # Runs a tool and holds what it printed.
       #
       # @param tool [String] a key of `TOOLS`

data/lib/hecks/served_options.rb

@@ -0,0 +1,53 @@
+require "rack"
+
+module Hecks
+  # What a domain's world file says it is served by: each `served_by("Adapter") { ... }` line
+  # names an inbound adapter and the per-environment values it needs. The route is derived,
+  # never written: a driving adapter answers at `/webhooks/<adapter name, snake-cased>` unless
+  # its `path` says otherwise, so a world holds only what the domain cannot know (secret,
+  # path override) and the same domain can be served differently in each environment.
+  #
+  # A secret is named by the environment variable that holds it, never inline.
+  module ServedOptions
+    VERB = "served_by".freeze
+
+    module_function
+
+    # @param world [Bluebook::World, nil] a domain's judged world
+    # @return [Array<Hash>] one entry per `served_by` line: `adapter`, `path` and its settings
+    def entries(world)
+      return [] unless world
+
+      world.settings.filter_map do |key, values|
+        next unless key.to_s.start_with?("#{VERB}:")
+
+        adapter = values.fetch(:adapter)
+        values.merge(adapter: adapter, path: values.fetch(:path) { "/webhooks/#{snake(adapter)}" })
+      end
+    end
+
+    # A Rack app mounting every `served_by` adapter the world names at its derived path.
+    #
+    # @param world [Bluebook::World, nil]
+    # @param adapters [Hash{String => Class}] driving adapter classes by the name a world uses;
+    #   each is built with `secret:` read from the environment variable the line names
+    # @param env [#fetch] where secrets are read from (`ENV` in production)
+    # @return [Rack::URLMap]
+    # @raise [KeyError] when a line names an adapter no class answers for
+    # @raise [ArgumentError] when a line names a secret variable the environment does not hold
+    def rack_app(world, adapters:, env: ENV)
+      routes = entries(world).to_h do |entry|
+        klass = adapters.fetch(entry[:adapter])
+        [entry[:path], klass.new(secret: secret_for(entry, env))]
+      end
+      Rack::URLMap.new(routes)
+    end
+
+    def secret_for(entry, env)
+      name = entry.fetch(:secret) { raise ArgumentError, "#{entry[:adapter]} names no secret" }
+      env.fetch(name) { raise ArgumentError, "#{entry[:adapter]}: environment variable #{name} is not set" }
+    end
+
+    def snake(name) = name.to_s.gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase
+  end
+end

data/lib/hecks/site/bluebook/site.bluebook

@@ -101,6 +101,7 @@ Hecks.bluebook "Site" do
     attribute :template,  Location,  optional: true
     attribute :cms,       Location,  optional: true
     attribute :root,      Location,  optional: true
+    attribute :editor,    Location,  optional: true
     attribute :extension, Extension, optional: true
     attribute :check,     Switch,    optional: true
     attribute :live,      Location,  optional: true
@@ -166,11 +167,12 @@ Hecks.bluebook "Site" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end
 
-    # `hecks site site_projection.project_site <project> [out=<dir>] [template=<file>] [cms=<dir>] [root=<dir>] [extension=ts|mts] [--check]`.
+    # `hecks site site_projection.project_site <project> [out=<dir>] [template=<file>] [cms=<dir>] [root=<dir>] [editor=<dir>] [extension=ts|mts] [--check]`.
     # With `check` nothing is written: a routes.ts that differs from the table is faulted, naming the
     # file, so a CI job fails on drift.
     command "ProjectSite" do
@@ -182,6 +184,7 @@ Hecks.bluebook "Site" do
       attribute :template,  Location,  optional: true
       attribute :cms,       Location,  optional: true
       attribute :root,      Location,  optional: true
+      attribute :editor,    Location,  optional: true
       attribute :extension, Extension, optional: true
       attribute :check,     Switch,    optional: true
 
@@ -191,6 +194,7 @@ Hecks.bluebook "Site" do
       sets :template
       sets :cms
       sets :root
+      sets :editor
       sets :extension
       sets :check
 
@@ -250,6 +254,25 @@ Hecks.bluebook "Site" do
       emits "SiteProbeRequested"
     end
 
+    # `hecks site site_projection.check_roles <project> url=<http://127.0.0.1:port>`. Dispatches every
+    # command the project declares a `role` for to a running host with no role and no actor, and
+    # checks the host refuses each as `Unauthorized`. Only a host on this machine is asked, and it
+    # must be running with `HECKS_ROLE_ENFORCEMENT=enforce`: a host that is not would run the
+    # commands. It prints a line per command and exits 1 when any is not refused for its role.
+    command "CheckRoles" do
+      goal "Check a host on this machine refuses every role-declaring command from a caller with no role"
+
+      attribute :domain, DomainPath
+      attribute :run,    RunKey
+      attribute :url,    SiteUrl
+
+      sets :domain
+      sets :run
+      sets :url
+
+      emits "RolesCheckRequested"
+    end
+
     command "Complete" do
       goal "Record that routes.ts was written, or found current, or the live edge matched, and what it said"
 
@@ -301,6 +324,11 @@ Hecks.bluebook "Site" do
     trigger SiteProjection::SiteToolchain::Probe, with: { run: :run }
   end
 
+  policy "RolesWhenRequested" do
+    on      "SiteProjection.RolesCheckRequested"
+    trigger SiteProjection::SiteToolchain::Roles, with: { run: :run }
+  end
+
   policy "RecordTheProjection" do
     on      "SiteProjection.SiteAnswered"
     trigger SiteProjection::Complete, with: { output: :output }

data/lib/hecks/site/bluebook/site.ports.hecksagon

@@ -23,5 +23,11 @@ Hecks.hecksagon "Site" do
       answers "SiteAnswered"
       refuses "SiteRefused"
     end
+
+    asks "Roles", to: SiteProjection do
+      attribute :run, RunKey
+      answers "SiteAnswered"
+      refuses "SiteRefused"
+    end
   end
 end

data/lib/hecks/storehouse/audit.rb

@@ -33,7 +33,7 @@ module Hecks
       end
 
       # Tails this bus's own dispatch/query/state audit log — a pull-based
-      # substitute for a push subscription, since a stdio door answers one
+      # substitute for a push subscription, since a stdio server answers one
       # request at a time with no channel to push through.
       #
       # @param runtime [Runtime::Registry] the booted domain to tail

data/lib/hecks/storehouse/dispatching.rb

@@ -34,9 +34,9 @@ module Hecks
 
       # :nodoc:
       def command_envelope(args, spec)
-        Doors::CommandRequest.normalize(Doors::JsonDoor.deep_symbolize(args),
-                                        receiver:        spec[:receiver],
-                                        legacy_receiver: spec[:legacy_receiver])
+        Adapters::Driving::CommandRequest.normalize(Adapters::Driving::Json.deep_symbolize(args),
+                                                    receiver:        spec[:receiver],
+                                                    legacy_receiver: spec[:legacy_receiver])
       end
 
       # :nodoc:
@@ -52,7 +52,9 @@ module Hecks
         ok(summary: summary,
            id:      result.id,
            state:   settled_state(runtime, spec, result),
-           events:  result.events.map { |event| { name: event.name, payload: Doors::JsonDoor.materialize(event.payload) } })
+           events:  result.events.map do |event|
+             { name: event.name, payload: Adapters::Driving::Json.materialize(event.payload) }
+           end)
       end
 
       # The record as its repository holds it once every reaction has run, which is the state the
@@ -65,7 +67,7 @@ module Hecks
       def settled_state(runtime, spec, result)
         return if result.state.nil?
 
-        Doors::JsonDoor.materialize(settled_record(runtime, spec, result) || result.state)
+        Adapters::Driving::Json.materialize(settled_record(runtime, spec, result) || result.state)
       end
 
       # :nodoc:
@@ -141,7 +143,7 @@ module Hecks
 
       # :nodoc:
       def batch_step(runtime, raw, summary, options)
-        step = Doors::JsonDoor.deep_symbolize(raw)
+        step = Adapters::Driving::Json.deep_symbolize(raw)
         dispatch(runtime: runtime, command: step[:command], args: step[:args] || {}, summary: summary, **options)
       end
     end

data/lib/hecks/storehouse/introspection.rb

@@ -68,7 +68,7 @@ module Hecks
       # @return [Hash] {ok: true, domain:, valid: true} plus :findings when deep;
       #   {ok: false, domain:, valid: false, error:} if the boot itself failed
       def validate(domain:, deep: false)
-        runtime = Hecks.boot(confine!(domain, "domain"), install_doors: false)
+        runtime = Hecks.boot(confine!(domain, "domain"), install_driving: false)
         result  = { ok: true, domain: domain, valid: true }
         result[:findings] = model_findings(runtime) if deep
         result
@@ -103,7 +103,7 @@ module Hecks
 
       # :nodoc:
       def journal_entries(repository)
-        repository.entries.map { |entry| { operation: entry.operation, id: entry.id, state: Doors::JsonDoor.materialize(entry.state) } }
+        repository.entries.map { |entry| { operation: entry.operation, id: entry.id, state: Adapters::Driving::Json.materialize(entry.state) } }
       end
 
       # Runs a domain's hand-curated .behaviors examples and reports the results.

data/lib/hecks/storehouse/querying.rb

@@ -27,12 +27,14 @@ module Hecks
         spec = resolve!(cli_for(request.bluebook), request.name, asking: true)
         rows = with_caller(request.role, request.actor_id) { answer(request, spec) }
 
-        ok(summary: request.summary, rows: rows.map { |row| Doors::JsonDoor.materialize(row) }).merge(verb: spec[:command])
+        ok(summary: request.summary, rows: rows.map do |row|
+          Adapters::Driving::Json.materialize(row)
+        end).merge(verb: spec[:command])
       end
 
       # :nodoc:
       def answer(request, spec)
-        request.runtime.query(spec[:command], **Doors::JsonDoor.deep_symbolize(request.args))
+        request.runtime.query(spec[:command], **Adapters::Driving::Json.deep_symbolize(request.args))
       end
 
       # Reads one aggregate's stored records directly, bypassing any declared
@@ -63,7 +65,7 @@ module Hecks
         repository = runtime.registry.repository(bluebook.name, ir)
         return ok(summary: summary, record: single_record(repository, ir, id)) if id
 
-        records = repository.all.map { |instance| Doors::JsonDoor.materialize(instance.to_h) }
+        records = repository.all.map { |instance| Adapters::Driving::Json.materialize(instance.to_h) }
         ok(summary: summary, count: records.length, records: records)
       end
 
@@ -71,7 +73,7 @@ module Hecks
       def single_record(repository, aggregate_ir, identity)
         instance = repository.find(identity) or
           raise Runtime::NotFound, "no #{aggregate_ir.hecks_name} found for id #{identity.inspect}"
-        Doors::JsonDoor.materialize(instance.to_h)
+        Adapters::Driving::Json.materialize(instance.to_h)
       end
     end
   end

data/lib/hecks/storehouse.rb

@@ -3,8 +3,8 @@ require "json"
 require "fileutils"
 require "time"
 require_relative "cache_dir"
-require_relative "doors/command_request"
-require_relative "doors/json_door"
+require_relative "adapters/driving/command_request"
+require_relative "adapters/driving/json"
 require_relative "naming"
 require_relative "projector"
 require_relative "runtime/errors"
@@ -55,7 +55,7 @@ module Hecks
             "own root (HECKS_STOREHOUSE_ROOT to widen it)"
     end
 
-    # The one bluebook this runtime booted; every whole-domain door assumes
+    # The one bluebook this runtime booted; every whole-domain entry point assumes
     # the same one-bluebook-per-boot shape.
     # :nodoc:
     def bluebook_for(runtime)
@@ -137,7 +137,7 @@ module Hecks
     def audit_fields(request) = request.to_h.slice(:summary, :source, :role, :actor_id)
 
     # dry_run? (Runtime::Dispatcher) only understands the pre-envelope flat
-    # args shape; this is the one door back into it from dispatch's own envelope.
+    # args shape; this is the one entry point back into it from dispatch's own envelope.
     # :nodoc:
     def flatten_legacy(envelope, receiver, legacy_receiver)
       facts = envelope[:with] || {}

data/lib/hecks/tools/comment_style/source_file.rb

@@ -14,6 +14,9 @@ module Hecks
     module CommentStyle
       # One parsed source file and the violations found in it.
       class SourceFile
+        # Raised when an automatic fix would change code rather than comments.
+        class Error < RuntimeError; end
+
         include LongBlocks
         include Masking
         include CapsWords
@@ -51,7 +54,7 @@ module Hecks
           return @source if output == @source
 
           unchanged = CommentStyle.code_tokens(@source) == CommentStyle.code_tokens(output)
-          raise "#{path}: fix would change code, refusing" unless unchanged
+          raise Error, "#{path}: fix would change code, refusing" unless unchanged
 
           output
         end

data/lib/hecks/tools/deploy_recipe_lint/fixtures.rb

@@ -9,6 +9,9 @@ module Hecks
     module DeployRecipeLint
       # Generated fixture domains for the deploy generator, so the lint has real Makefiles to read.
       module Fixtures
+        # Raised when a deploy fixture cannot be generated.
+        class Error < RuntimeError; end
+
         # The fixture's bluebook, where `__NAME__` stands for the domain's name.
         FIXTURE_BLUEBOOK = <<~BLUEBOOK
           Hecks.bluebook "__NAME__" do
@@ -59,7 +62,7 @@ module Hecks
           Dir.mktmpdir do |dir|
             domain_dir = write_fixture(dir, basename, world_body, env_local: env_local)
             outcome = Hecks::Adapters::ConsoleCapture.capture { DeployRecipe.main([domain_dir], root: root) }
-            outcome.ok? or raise "hecks deploy project failed generating the #{basename} fixture: #{outcome.output}"
+            outcome.ok? or raise Error, "hecks deploy project failed generating the #{basename} fixture: #{outcome.output}"
           end
           File.join(root, "deploy", basename)
         end

data/lib/hecks/tools/lanes/rows.rb

@@ -29,9 +29,15 @@ module Hecks
           return "#{name} has guarded #{lane["guarded"].inspect}" unless %w[yes no].include?(lane["guarded"])
           return "#{name} has alert_after #{lane["alert_after"].inspect}, not whole hours" unless hours?(lane)
 
+          return "#{name} has release_trailer #{lane["release_trailer"].inspect}, not a trailer word" unless trailer?(lane)
+
           follows_problem(lane, names)
         end
 
+        # @return [Boolean] whether `release_trailer` is empty (nothing is released from the lane)
+        #   or a git trailer key such as `Release-Approved-By`
+        def trailer?(lane) = lane["release_trailer"].to_s.match?(/\A([A-Za-z][A-Za-z0-9]*(-[A-Za-z0-9]+)*)?\z/)
+
         # @return [Boolean] whether `alert_after` is empty (never late) or whole hours
         def hours?(lane) = lane["alert_after"].to_s.match?(/\A\d*\z/)
 

data/lib/hecks/tools/oidc_manifests.rb

@@ -10,9 +10,8 @@ module Hecks
     #
     # A domain that has no bluebook is skipped and one that cannot be projected is reported, so a
     # sweep over the whole checkout carries on past either. `hecks deploy
-    # oidc_manifest.project_oidc` loads
-    # `bundler/setup` first, which pins the `json` gem: newer releases pretty-print an empty array
-    # as `[\n\n]`, a diff spec/oidc_manifest_spec.rb would report as drift.
+    # oidc_manifest.project_oidc` writes through `Hecks::Projections::OIDC.render`, which spells an
+    # empty list `[]` whichever json release is loaded, so the text does not depend on the machine.
     module OidcManifests
       # Directories that hold a `.hecksagon` but are never domains.
       NOT_DOMAINS = %r{\A(rust|deploy|tmp|coverage)/}
@@ -50,7 +49,7 @@ module Hecks
       # @param path [String] a domain directory, relative to `root`
       # @return [void]
       def project(root, path)
-        runtime = Hecks.boot(File.join(root, path), install_doors: false)
+        runtime = Hecks.boot(File.join(root, path), install_driving: false)
         name    = runtime.registry.bluebooks.keys.first
         return warn("  #{path}: no bluebook found — skipped") unless name
 
@@ -65,7 +64,7 @@ module Hecks
       # @param out [String] where the manifest goes
       # @return [void]
       def write_manifest(registry, name, out)
-        Hecks::Projector.write(Hecks::Projector.call(:oidc, bluebook: registry.bluebook(name)), out)
+        File.write(out, Hecks::Projections::OIDC.render(Hecks::Projector.call(:oidc, bluebook: registry.bluebook(name))))
       end
     end
   end

data/lib/hecks/tools/regeneration_run.rb

@@ -8,13 +8,13 @@ require_relative "../corpus"
 
 module Hecks
   module Tools
-    # Regenerates every corpus domain's committed Rust output with `hecks project_rust`, or checks
-    # that the committed output is what a regeneration would write.
+    # Regenerates every corpus domain's Rust output with `hecks project_rust`, or checks that the
+    # output on disk is what that would write. Only pizzas, `mod.rs` and `Cargo.toml` are committed.
     #
     # The domain list comes from `Hecks::Corpus.rust_regen_order`, never a hand-kept list. The
     # order is fixed (sorted by relative path): domains that share governance/, identity/,
-    # Cargo.toml and generated/mod.rs stamp them with whichever ran last, so it must not flap. If
-    # the domain set or the sort rule changes, re-run and commit the output; never hand-edit stamps.
+    # Cargo.toml and generated/mod.rs stamp them with whichever ran last, so it must not flap.
+    # If the domain set or the sort rule changes, re-run and commit what changed.
     #
     #   hecks regenerate_corpus         # discover, regenerate, print the plan
     #   hecks regenerate_corpus --check # regenerate into a scratch crate; fail on any difference
@@ -27,6 +27,11 @@ module Hecks
                    "wrong directory, or something upstream deleted rust/src/generated/ entirely. Refusing " \
                    "to silently treat that as \"nothing to regenerate.\""
 
+      # The refusal when a check finds nothing generated to compare.
+      NOT_MATERIALIZED = "hecks regenerate_corpus --check: rust/src/generated has no generated output to compare. " \
+                         "Only pizzas, mod.rs and Cargo.toml are committed; run " \
+                         "`hecks regenerate_corpus --confirm` first, then the check."
+
       module_function
 
       # Regenerates the corpus, or checks it.
@@ -147,6 +152,8 @@ module Hecks
       # @param root [String] the checkout
       # @return [String] the scratch directory
       def scratch_crate(root)
+        abort NOT_MATERIALIZED unless File.directory?(File.join(root, "rust/src/generated/meta"))
+
         scratch = Dir.mktmpdir("regen-codegen-check")
         FileUtils.mkdir_p(File.join(scratch, "src"))
         FileUtils.cp_r(File.join(root, "rust/src/generated"), File.join(scratch, "src/generated"))

data/lib/hecks/tools/site_routes/cli.rb

@@ -13,7 +13,7 @@ module Hecks
         # The flags that take a value, by the keyword of `projection` each one sets.
         VALUE_FLAGS = {
           out: "--out=DIR", template: "--template=FILE", cms: "--cms=DIR", root_dir: "--root=DIR",
-          extension: "--extension=EXT"
+          editor: "--editor=DIR", extension: "--extension=EXT"
         }.freeze
 
         # @param argv [Array<String>] the command line, consumed down to the project directory