hecks 4.0.0 → 6.0.0

data/lib/hecks/framework/bluebook/compliance.bluebook

@@ -10,163 +10,64 @@ Hecks.bluebook "Compliance" do
   # Contain first, investigate second: the containing action (a freeze, a box surrender) has
   # already happened elsewhere. This domain is told the fact and records the review after it.
   #
-  # One aggregate per triggering event: the events carry different fields, so a shared
-  # aggregate would need an artificial union of the shapes.
+  # It names no consumer. What is reviewed is a subject: a kind the consumer chooses and the
+  # subject's identity as its own context writes it. The consuming context maps its own event to
+  # those two in the `with:` of its policy, which is where that translation belongs (ADR 0143),
+  # reading the event's record as `:id` (ADR 0153).
 
-  aggregate "AccountFreezeReview" do
-    description "The compliance review a frozen account gets, opened the moment Banking::Account.Freeze already happened."
+  aggregate "Review" do
+    description "The compliance review of one subject another context already acted on, opened the moment it happened."
 
-    attribute :number, AccountNumber
+    attribute :subject_kind, SubjectKind
+    attribute :subject_key,  SubjectKey
 
-    identified_by :number
+    identified_by :subject_kind, :subject_key
 
-    value_object "AccountNumber" do
+    # What kind of thing is reviewed, in the consumer's own words: `account_freeze`, `box_surrender`.
+    value_object "SubjectKind" do
       attribute :value, String
-      invariant("an account number is present") { !value.to_s.empty? }
+      invariant("a review names the kind of thing it reviews") { !value.to_s.empty? }
     end
 
-    lifecycle :status, default: "open" do
-      transition "Clear"    => "cleared",   from: "open"
-      transition "Escalate" => "escalated", from: "open"
-    end
-
-    # System-triggered. Takes only `number`, the one field `AccountFrozen` carries; an
-    # unrecognized field is refused at the JSON boundary rather than dropped.
-    command "Open" do
-      role "System"
-      goal "Register that a frozen account needs compliance review"
-
-      sets :number
-
-      emits AccountFreezeReviewOpened
-    end
-
-    command "Clear" do
-      role "Compliance officer"
-      goal "Confirm the freeze was warranted, or resolve it, with nothing further to escalate"
-
-      reference_to AccountFreezeReview
-
-      emits AccountFreezeReviewCleared
-    end
-
-    command "Escalate" do
-      role "Compliance officer"
-      goal "Send a genuine finding on to whatever handles it next — a formal filing, a longer hold, a referral"
-
-      reference_to AccountFreezeReview
-
-      emits AccountFreezeReviewEscalated
-    end
-  end
-
-  aggregate "BoxSurrenderReview" do
-    description "The compliance review a surrendered safe deposit box gets — audit/escheatment implications, not a fraud contain the way a freeze is, but the same after-the-fact review shape."
-
-    attribute :branch_code, BranchCode
-    attribute :box_number,  BoxNumber
-
-    identified_by :branch_code, :box_number
-
-    value_object "BranchCode" do
-      attribute :value, String
-      invariant("a branch is coded") { !value.to_s.empty? }
-    end
-
-    value_object "BoxNumber" do
-      attribute :value, Integer
-      invariant("a box is numbered from one") { value.positive? }
-    end
-
-    lifecycle :status, default: "open" do
-      transition "Clear"    => "cleared",   from: "open"
-      transition "Escalate" => "escalated", from: "open"
-    end
-
-    # Takes exactly the fields `BoxSurrendered` carries, as `AccountFreezeReview.Open` does.
-    command "Open" do
-      role "System"
-      goal "Register that a surrendered box needs compliance review"
-
-      sets :branch_code
-      sets :box_number
-
-      emits BoxSurrenderReviewOpened
-    end
-
-    command "Clear" do
-      role "Compliance officer"
-      goal "Confirm the surrender needs no further compliance action"
-
-      reference_to BoxSurrenderReview
-
-      emits BoxSurrenderReviewCleared
-    end
-
-    command "Escalate" do
-      role "Compliance officer"
-      goal "Send a genuine finding on to whatever handles it next"
-
-      reference_to BoxSurrenderReview
-
-      emits BoxSurrenderReviewEscalated
-    end
-  end
-
-  # A third shape, not a union of the other two: `Privacy::Marking`'s `Marked` event carries
-  # `domain`/`attribute_path`. Reached via `translates` in whichever `.hecksagon` attaches
-  # both Privacy and Compliance, since which foreign event to conform to is wiring.
-  aggregate "PrivacyReview" do
-    description "The compliance review a newly marked sensitive field gets, opened the moment Privacy::Marking.Mark already happened."
-
-    attribute :domain,         Domain
-    attribute :attribute_path, AttributePath
-
-    identified_by :domain, :attribute_path
-
-    value_object "Domain" do
+    # The subject's identity as its own context writes it; a composite one is joined by a colon.
+    value_object "SubjectKey" do
       attribute :value, String
-      invariant("a review names the domain whose attribute was marked") { !value.to_s.empty? }
-    end
-
-    value_object "AttributePath" do
-      attribute :value, String
-      invariant("a review names the attribute that was marked") { !value.to_s.empty? }
+      invariant("a review names the subject it reviews") { !value.to_s.empty? }
     end
 
     lifecycle :status, default: "open" do
       transition "Clear"    => "cleared",   from: "open"
       transition "Escalate" => "escalated", from: "open"
+      mark :terminal, "cleared", "escalated"
     end
 
-    # System-triggered. Takes only `Marking`'s identity fields; `category`/`readable_by` stay
-    # on the marking.
+    # System-triggered. A refused field is refused at the JSON boundary rather than dropped.
     command "Open" do
       role "System"
-      goal "Register that a newly marked sensitive field needs compliance review"
+      goal "Register that something another context acted on needs compliance review"
 
-      sets :domain
-      sets :attribute_path
+      sets :subject_kind
+      sets :subject_key
 
-      emits PrivacyReviewOpened
+      emits ReviewOpened
     end
 
     command "Clear" do
       role "Compliance officer"
-      goal "Confirm the marking was warranted, or resolve it, with nothing further to escalate"
+      goal "Confirm the action was warranted, or resolve it, with nothing further to escalate"
 
-      reference_to PrivacyReview
+      reference_to Review
 
-      emits PrivacyReviewCleared
+      emits ReviewCleared
     end
 
     command "Escalate" do
       role "Compliance officer"
-      goal "Send a genuine finding on to whatever handles it next"
+      goal "Send a genuine finding on to whatever handles it next — a formal filing, a longer hold, a referral"
 
-      reference_to PrivacyReview
+      reference_to Review
 
-      emits PrivacyReviewEscalated
+      emits ReviewEscalated
     end
   end
 end

data/lib/hecks/framework/bluebook/console_settings.bluebook

@@ -7,7 +7,7 @@ Hecks.bluebook "ConsoleSettings" do
   # plus a `Hecks.hecksagon "ConsoleSettings" do ... end` persistence binding.
 
   # Named ConsoleSettings, not "Forms" — Hecks::Forms (lib/hecks/forms/) names a
-  # different thing, a raw form/query renderer straight off any IR. This chapter
+  # different thing, a raw form/query renderer straight off any IR. This bluebook
   # is a curated, hand-authored dashboard's own settings.
 
   # Scopes everything presentation.yml carries except a collection's own
@@ -69,10 +69,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Color one state"
 
       reference_to StateStyle
-      attribute :tone, one_of("good", "warn", "danger", "muted", "accent")
+      attribute :tone, one_of("good", "warn", "danger", "muted", "accent"), sets: true
 
-      sets :tone
-      emits ToneSet
+      emits StateStyleToned
     end
 
     command "SetAttention" do
@@ -80,10 +79,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Mark whether one state needs a person's attention"
 
       reference_to StateStyle
-      attribute :attention, Flag
+      attribute :attention, Flag, sets: true
 
-      sets :attention
-      emits AttentionSet
+      emits StateStyleFlagged
     end
 
     command "SetExtra" do
@@ -91,15 +89,14 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Carry whatever per-state fields aren't individually modeled yet (label, note, ...)"
 
       reference_to StateStyle
-      attribute :extra_json, StateStyleExtra
+      attribute :extra_json, StateStyleExtra, sets: true
 
-      sets :extra_json
-      emits StateStyleExtraSet
+      emits StateStyleAnnotated
     end
   end
 
   aggregate "Collection" do
-    description "One app aggregate's own console presentation — nav label, curated columns, detail-panel fields (with an optional entity state_filter and a row_columns subset), identity-assignment strategy, field formats, preconditions, and which query lists it. Every list-shaped piece is rows on this root, never a nested list inside a value object — the same 'an open map is rows on a head' shape Wiring::Setting and Query::AskOption already use, and the same reason: no value object here can hold a map, and this sidesteps ever needing to find out whether one can hold a plain list either."
+    description "One app aggregate's own console presentation — how it is named in the nav, where it sits, which field stands in for a whole record, and which query lists it. Its columns, detail-panel fields, identity assignment, preconditions and field formats are each a consistency boundary of their own: CollectionLayout, CollectionIdentity and CollectionRules, keyed by the same `agg`."
 
     attribute :agg,                  SettingsText
 
@@ -110,19 +107,6 @@ Hecks.bluebook "ConsoleSettings" do
     attribute :nav_order,            SettingsNumber, optional: true
     attribute :primary_field,        SettingsText, optional: true
     attribute :list_query,           SettingsText, optional: true
-    attribute :identity_field,       SettingsText, optional: true
-    attribute :identity_strategy,    one_of("slug", "sequence", "port"), optional: true
-    attribute :identity_source,      SettingsText, optional: true
-    attribute :identity_prefix,      SettingsText, optional: true
-    # `pad` (a sequence strategy's zero-padding width, e.g. "C-004" vs "C-4")
-    # is real but unmodeled here, same as identity_source/identity_prefix —
-    # carried opaquely in identity_extra_json below.
-    attribute :identity_extra_json,  CollectionExtra, optional: true
-    attribute :columns,              list_of(Column)
-    attribute :detail_fields,        list_of(DetailField)
-    attribute :detail_field_columns, list_of(DetailFieldColumn)
-    attribute :preconditions,        list_of(Precondition)
-    attribute :field_formats,        list_of(FieldFormat)
     # Carries real, in-use fields this schema doesn't model (e.g. `noun_sing`,
     # `create_label`, `nav_group`) — opaque, same as StateStyle's extra_json.
     attribute :extra_json,           CollectionExtra, optional: true
@@ -136,61 +120,11 @@ Hecks.bluebook "ConsoleSettings" do
       attribute :value, Integer
     end
 
-    # Shared by extra_json and identity_extra_json — both opaque JSON text, no
-    # reason for two wrapper types. A bare `String` fails on an attribute directly.
+    # Opaque JSON text; a bare `String` fails on an attribute directly.
     value_object "CollectionExtra" do
       attribute :value, String
     end
 
-    # A list/table column. `sortable`/`sort_default` are optional (most columns
-    # take the frontend's default). `sort_default` stays a plain String rather
-    # than a closed `one_of` (ADR 0025) — PresentationConfig.validate! checks it.
-    value_object "Column" do
-      attribute :field,        String
-      attribute :sortable,     String, optional: true  # "true"/"false" — see StateStyle.attention's own comment
-      attribute :sort_default, String, optional: true
-      # `head`/`as`/`hop` confirmed live as real, in-use column-level
-      # overrides this schema didn't model — verified-then-opaque, same
-      # reasoning as StateStyle's own extra_json.
-      attribute :extra_json,   String, optional: true
-    end
-
-    # One field the detail panel shows. `state_filter` only applies to an
-    # entity-backed rows field; nothing here enforces that, since it needs the
-    # app's own live IR — PresentationConfig.validate! checks it in Ruby.
-    value_object "DetailField" do
-      attribute :field,        String
-      attribute :display,      String, optional: true
-      attribute :state_filter, String, optional: true
-      # `head`/`as`/`hop` confirmed live as real, in-use detail-field
-      # overrides this schema didn't model — verified-then-opaque, same
-      # reasoning as StateStyle's own extra_json.
-      attribute :extra_json,   String, optional: true
-    end
-
-    # A rows-shaped detail field's sub-column filter, flattened to one row per
-    # (field, column) pair and grouped back by `field` on the way out — the
-    # same flattening Query::AskOption uses for a compound option's parts.
-    value_object "DetailFieldColumn" do
-      attribute :field,  String
-      attribute :column, String
-    end
-
-    value_object "Precondition" do
-      attribute :field, String
-      attribute :state, String
-      # `message` (a custom refusal message override) confirmed live as
-      # real, in-use — verified-then-opaque, same reasoning as
-      # StateStyle's own extra_json.
-      attribute :extra_json, String, optional: true
-    end
-
-    # `format` stays a plain String too — same nested-`one_of` collision.
-    value_object "FieldFormat" do
-      attribute :field,  String
-      attribute :format, String
-    end
-
     command "Declare" do
       role "Console"
       goal "Give one app aggregate a presentation row, before anything is curated on it yet"
@@ -207,10 +141,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Name a collection's own nav label"
 
       reference_to Collection
-      attribute :label, SettingsText
+      attribute :label, SettingsText, sets: true
 
-      sets :label
-      emits LabelSet
+      emits CollectionLabeled
     end
 
     command "SetKey" do
@@ -218,10 +151,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Override a collection's own nav/route key"
 
       reference_to Collection
-      attribute :key, SettingsText
+      attribute :key, SettingsText, sets: true
 
-      sets :key
-      emits KeySet
+      emits CollectionKeyed
     end
 
     command "SetNavOrder" do
@@ -229,10 +161,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Place a collection in the nav"
 
       reference_to Collection
-      attribute :nav_order, SettingsNumber
+      attribute :nav_order, SettingsNumber, sets: true
 
-      sets :nav_order
-      emits NavOrderSet
+      emits CollectionPlaced
     end
 
     command "SetPrimaryField" do
@@ -240,10 +171,9 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Name which field stands in for a whole record"
 
       reference_to Collection
-      attribute :primary_field, SettingsText
+      attribute :primary_field, SettingsText, sets: true
 
-      sets :primary_field
-      emits PrimaryFieldSet
+      emits PrimaryFieldChosen
     end
 
     command "SetListQuery" do
@@ -251,95 +181,232 @@ Hecks.bluebook "ConsoleSettings" do
       goal "Name which of an aggregate's own queries lists its records"
 
       reference_to Collection
-      attribute :list_query, SettingsText
+      attribute :list_query, SettingsText, sets: true
+
+      emits ListQueryChosen
+    end
+
+    command "SetExtra" do
+      role "Console"
+      goal "Carry whatever per-collection fields aren't individually modeled yet (noun_sing, create_label, nav_group, ...)"
+
+      reference_to Collection
+      attribute :extra_json, CollectionExtra, sets: true
+
+      emits CollectionAnnotated
+    end
+  end
+
+  aggregate "CollectionIdentity" do
+    description "How one app aggregate's console assigns its own new records' identity — the field, the strategy (slug, sequence or a port), and the strategy's source and prefix. One consistency boundary: a strategy and its prefix change together or not at all."
+
+    attribute :agg, IdentityText
+
+    identified_by :agg
+
+    attribute :identity_field,       IdentityText, optional: true
+    attribute :identity_strategy,    one_of("slug", "sequence", "port"), optional: true
+    attribute :identity_source,      IdentityText, optional: true
+    attribute :identity_prefix,      IdentityText, optional: true
+    # `pad` (a sequence strategy's zero-padding width, e.g. "C-004" vs "C-4")
+    # is real but unmodeled here, same as identity_source/identity_prefix —
+    # carried opaquely in identity_extra_json below.
+    attribute :identity_extra_json,  IdentityExtra, optional: true
+
+    value_object "IdentityText" do
+      attribute :value, String
+      invariant("names something") { !value.to_s.empty? }
+    end
+
+    value_object "IdentityExtra" do
+      attribute :value, String
+    end
+
+    command "Declare" do
+      role "Console"
+      goal "Give one app aggregate's identity a row, before anything is curated on it yet"
+
+      attribute :agg, IdentityText
+
+      given("a identity names its own aggregate") { !agg.value.to_s.empty? }
 
-      sets :list_query
-      emits ListQuerySet
+      emits CollectionIdentityDeclared
     end
 
     command "SetIdentity" do
       role "Console"
       goal "Name how a collection assigns its own new records' identity"
 
-      reference_to Collection
-      attribute :identity_field,       SettingsText
-      attribute :identity_strategy,    one_of("slug", "sequence", "port")
+      reference_to CollectionIdentity
+      attribute :identity_field,       IdentityText, sets: true
+      attribute :identity_strategy,    one_of("slug", "sequence", "port"), sets: true
 
-      sets :identity_field
-      sets :identity_strategy
       sets :identity_source
       sets :identity_prefix
       sets :identity_extra_json
-      emits IdentitySet
+      emits CollectionIdentified
     end
+  end
 
-    command "SetExtra" do
+  aggregate "CollectionLayout" do
+    description "What one app aggregate's console shows: the table columns, the detail-panel fields (with an optional entity state_filter and a row_columns subset). Every list-shaped piece is rows on this root, never a nested list inside a value object — no value object here can hold a map, and this sidesteps ever finding out whether one can hold a plain list either. Each list is replaced whole, never patched."
+
+    attribute :agg, LayoutText
+
+    identified_by :agg
+
+    attribute :columns,              list_of(Column)
+    attribute :detail_fields,        list_of(DetailField)
+    attribute :detail_field_columns, list_of(DetailFieldColumn)
+
+    value_object "LayoutText" do
+      attribute :value, String
+      invariant("names something") { !value.to_s.empty? }
+    end
+
+    # A list/table column. `sortable`/`sort_default` are optional (most columns
+    # take the frontend's default). `sort_default` stays a plain String rather
+    # than a closed `one_of` (ADR 0025) — PresentationConfig.validate! checks it.
+    value_object "Column" do
+      attribute :field,        String
+      attribute :sortable,     String, optional: true  # "true"/"false" — see StateStyle.attention's own comment
+      attribute :sort_default, String, optional: true
+      # `head`/`as`/`hop` confirmed live as real, in-use column-level
+      # overrides this schema didn't model — verified-then-opaque, same
+      # reasoning as StateStyle's own extra_json.
+      attribute :extra_json,   String, optional: true
+    end
+
+    # One field the detail panel shows. `state_filter` only applies to an
+    # entity-backed rows field; nothing here enforces that, since it needs the
+    # app's own live IR — PresentationConfig.validate! checks it in Ruby.
+    value_object "DetailField" do
+      attribute :field,        String
+      attribute :display,      String, optional: true
+      attribute :state_filter, String, optional: true
+      # `head`/`as`/`hop` confirmed live as real, in-use detail-field
+      # overrides this schema didn't model — verified-then-opaque, same
+      # reasoning as StateStyle's own extra_json.
+      attribute :extra_json,   String, optional: true
+    end
+
+    # A rows-shaped detail field's sub-column filter, flattened to one row per
+    # (field, column) pair and grouped back by `field` on the way out — the
+    # same flattening Query::AskOption uses for a compound option's parts.
+    value_object "DetailFieldColumn" do
+      attribute :field,  String
+      attribute :column, String
+    end
+    command "Declare" do
       role "Console"
-      goal "Carry whatever per-collection fields aren't individually modeled yet (noun_sing, create_label, nav_group, ...)"
+      goal "Give one app aggregate's layout a row, before anything is curated on it yet"
 
-      reference_to Collection
-      attribute :extra_json, CollectionExtra
+      attribute :agg, LayoutText
 
-      sets :extra_json
-      emits CollectionExtraSet
+      given("a layout names its own aggregate") { !agg.value.to_s.empty? }
+
+      emits CollectionLayoutDeclared
     end
 
     command "ReplaceColumns" do
       role "Console"
       goal "Replace a collection's own whole list of table columns"
 
-      reference_to Collection
+      reference_to CollectionLayout
 
       sets :columns
-      emits ColumnsReplaced
+      emits ColumnsArranged
     end
 
     command "ReplaceDetailFields" do
       role "Console"
       goal "Replace a collection's own whole list of detail-panel fields"
 
-      reference_to Collection
+      reference_to CollectionLayout
 
       sets :detail_fields
-      emits DetailFieldsReplaced
+      emits DetailFieldsArranged
     end
 
     command "ReplaceDetailFieldColumns" do
       role "Console"
       goal "Replace every rows-field's own sub-column filter, whole"
 
-      reference_to Collection
+      reference_to CollectionLayout
 
       sets :detail_field_columns
-      emits DetailFieldColumnsReplaced
+      emits DetailFieldColumnsArranged
+    end
+  end
+
+  aggregate "CollectionRules" do
+    description "The rules one app aggregate's console applies: the dispatch preconditions that gate a command on a field's state, and the display format of each field. Each list is replaced whole, never patched."
+
+    attribute :agg, RulesText
+
+    identified_by :agg
+
+    attribute :preconditions,        list_of(Precondition)
+    attribute :field_formats,        list_of(FieldFormat)
+
+    value_object "RulesText" do
+      attribute :value, String
+      invariant("names something") { !value.to_s.empty? }
+    end
+
+    value_object "Precondition" do
+      attribute :field, String
+      attribute :state, String
+      # `message` (a custom refusal message override) confirmed live as
+      # real, in-use — verified-then-opaque, same reasoning as
+      # StateStyle's own extra_json.
+      attribute :extra_json, String, optional: true
+    end
+
+    # `format` stays a plain String too — same nested-`one_of` collision.
+    value_object "FieldFormat" do
+      attribute :field,  String
+      attribute :format, String
+    end
+
+    command "Declare" do
+      role "Console"
+      goal "Give one app aggregate's rules a row, before anything is curated on it yet"
+
+      attribute :agg, RulesText
+
+      given("a rules names its own aggregate") { !agg.value.to_s.empty? }
+
+      emits CollectionRulesDeclared
     end
 
     command "ReplacePreconditions" do
       role "Console"
       goal "Replace a collection's own whole list of dispatch preconditions"
 
-      reference_to Collection
+      reference_to CollectionRules
 
       sets :preconditions
-      emits PreconditionsReplaced
+      emits PreconditionsRestated
     end
 
     command "ReplaceFieldFormats" do
       role "Console"
       goal "Replace a collection's own whole list of field display formats"
 
-      reference_to Collection
+      reference_to CollectionRules
 
       sets :field_formats
-      emits FieldFormatsReplaced
+      emits FieldFormatsChosen
     end
   end
 
+
   # Domain-wide, not per-aggregate: exactly one row, ever, for the whole
   # console. `key` holds a literal constant ("overview") rather than anything
   # chosen, since a creating command still needs some identity to hydrate against.
   aggregate "Overview" do
-    description "The console's own dashboard stat cards, whole. One row, ever — `key` is always the literal 'overview', never chosen. Every stat gets replaced as a whole list on save, the same 'replace whole, never patch one' convention Collection's own columns/detail_fields/preconditions/field_formats already use."
+    description "The console's own dashboard stat cards, whole. One row, ever — `key` is always the literal 'overview', never chosen. Every stat gets replaced as a whole list on save, the same 'replace whole, never patch one' convention CollectionLayout's and CollectionRules' own lists already use."
 
     attribute :key, OverviewKey
 
@@ -381,7 +448,7 @@ Hecks.bluebook "ConsoleSettings" do
       reference_to Overview
 
       sets :stats
-      emits StatsReplaced
+      emits OverviewStatsArranged
     end
   end
 
@@ -399,4 +466,22 @@ Hecks.bluebook "ConsoleSettings" do
     include Collection
     group_by :agg
   end
+
+  read_model "CuratedIdentities" do
+    description "Every CollectionIdentity row, nested by the app aggregate whose records it identifies."
+    include CollectionIdentity
+    group_by :agg
+  end
+
+  read_model "CuratedLayouts" do
+    description "Every CollectionLayout row, nested by the app aggregate whose columns and detail fields it arranges."
+    include CollectionLayout
+    group_by :agg
+  end
+
+  read_model "CuratedRules" do
+    description "Every CollectionRules row, nested by the app aggregate whose preconditions and formats it states."
+    include CollectionRules
+    group_by :agg
+  end
 end

data/lib/hecks/framework/bluebook/framework.hecksagon

@@ -21,3 +21,10 @@ Hecks.hecksagon "Identity" do
   attaches "Governance"
   persisted_by "Memory"
 end
+
+# Privacy's `Keys` port is declared in privacy.ports.hecksagon, beside its adapter binding.
+Hecks.hecksagon "Privacy" do
+  # `Marking.Mark` declares `role "Deployment"` and `Shred` a privacy officer; same reason as Compliance.
+  attaches "Governance"
+  persisted_by "Memory"
+end