hecks 4.0.0 → 6.0.0

data/lib/hecks/hecks/deploy.behaviors

@@ -1,7 +1,7 @@
 Hecks.behaviors "Deploy" do
   vision "A recipe, a lint, a comparison or a projection is recorded as requested before anything outside is asked."
 
-  loads "hecks.bluebook", "custodian.bluebook", "tooling.bluebook", "rehearsal.bluebook", "codebase.bluebook", "context_map.hecksagon", "hecks.hecksagon", "deploy.world", "environments/memory.world"
+  loads "hecks.bluebook", "custodian.bluebook", "tooling.bluebook", "rehearsal.bluebook", "agents.bluebook", "codebase.bluebook", "ledger.bluebook", "context_map.hecksagon", "hecks.hecksagon", "deploy.world", "environments/memory.world"
 
   test "Project keeps a domain that has no world file as a faulted recipe" do
     tests "Project", on: "Recipe"

data/lib/hecks/hecks/deploy.world

@@ -1,7 +1,6 @@
-# The Deploy chapter's launcher when the Hecks domain attaches it: `hecks deploy <verb>` reads the
-# world named for the chapter, as `hecks.world` does for the Hecks chapter's own verbs. Its store
-# is not set here: hecks.world's `default_adapter` fills the gap, so the memory overlay swaps it
-# with the rest.
+# The Deploy bluebook's launcher when the Hecks domain attaches it: `hecks deploy <verb>` reads the
+# world named for the bluebook, as `hecks.world` does for the Hecks bluebook's own verbs. Its store
+# is not set here: the bluebook takes the one the Hecks domain gives the bluebooks it attaches.
 #
 # `run_keys` mints the `run` key of a recipe, a lint, a comparison or a manifest projection, and
 # `--wait` reports a faulted, flagged, drifted or refused run as exit 1.

data/lib/hecks/hecks/hecks.behaviors

@@ -1,7 +1,7 @@
 Hecks.behaviors "Hecks" do
   vision "A release moves tagged, published, verified; the grammar cache moves fresh, stale, fresh."
 
-  loads "hecks.bluebook", "custodian.bluebook", "tooling.bluebook", "rehearsal.bluebook", "codebase.bluebook", "context_map.hecksagon", "hecks.hecksagon", "environments/memory.world"
+  loads "hecks.bluebook", "custodian.bluebook", "tooling.bluebook", "rehearsal.bluebook", "agents.bluebook", "codebase.bluebook", "ledger.bluebook", "context_map.hecksagon", "hecks.hecksagon", "environments/memory.world"
 
   test "Tag records a version as tagged" do
     tests "Tag", on: "Release"
@@ -10,7 +10,7 @@ Hecks.behaviors "Hecks" do
   end
 
   test "MarkPublished advances a tagged release" do
-    # The setup is spelled in full: the attached QualityControl chapter also has a `Tag` command.
+    # The setup is spelled in full: the attached QualityControl bluebook also has a `Tag` command.
     tests "MarkPublished", on: "Release"
     setup  "Hecks::Release.Tag", version: { value: "3.0.0" }, ir_version: { value: "1.0.0" }, ships_from: { path: "/work/hecks" }
     input  version: { value: "3.0.0" }

data/lib/hecks/hecks/hecks.bluebook

@@ -8,7 +8,7 @@ Hecks.bluebook "Hecks" do
     attribute :version,    Version
     attribute :ir_version, Version
     attribute :ships_from, Checkout, optional: true
-    # The findings the version settled, by the key the Tickets chapter gives them.
+    # The findings the version settled, by the key the Tickets bluebook gives them.
     attribute :closes,     list_of(FindingKey), optional: true
 
     identified_by :version
@@ -18,7 +18,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "Version" do
-      attribute :value, String, pattern: '^[0-9]+[.][0-9]+[.][0-9]+'
+      attribute :value, String, matches: :version
 
       invariant("a version is present") { !value.to_s.empty? }
     end
@@ -38,13 +38,10 @@ Hecks.bluebook "Hecks" do
       role "Maintainer"
       goal "Record a version as tagged, with the IR version it carries"
 
-      attribute :version,    Version
-      attribute :ir_version, Version
-      attribute :ships_from, Checkout
+      attribute :version,    Version, sets: true
+      attribute :ir_version, Version, sets: true
+      attribute :ships_from, Checkout, sets: true
 
-      sets :version
-      sets :ir_version
-      sets :ships_from
 
       emits Tagged
     end
@@ -72,9 +69,8 @@ Hecks.bluebook "Hecks" do
       goal "Record the findings this version settled"
 
       reference_to Release
-      attribute :closes, list_of(FindingKey)
+      attribute :closes, list_of(FindingKey), sets: true
 
-      sets :closes
 
       emits FindingsClosed
     end
@@ -87,7 +83,7 @@ Hecks.bluebook "Hecks" do
   end
 
   aggregate "SyntaxBootCache" do
-    description "The grammar chapters' on-disk boot cache, keyed by a digest of the chapters it was built from."
+    description "The grammar bluebooks' on-disk boot cache, keyed by a digest of the bluebooks it was built from."
 
     attribute :digest, Digest
 
@@ -106,11 +102,10 @@ Hecks.bluebook "Hecks" do
 
     command "Record" do
       role "Maintainer"
-      goal "Record a boot cache as built from the grammar chapters that hash to this digest"
+      goal "Record a boot cache as built from the grammar bluebooks that hash to this digest"
 
-      attribute :digest, Digest
+      attribute :digest, Digest, sets: true
 
-      sets :digest
 
       emits CacheRecorded
     end

data/lib/hecks/hecks/hecks.contextmap

@@ -0,0 +1,25 @@
+# The Hecks domain's context map (ADR 0135): the contexts the gem carries and how they relate, written
+# before the wiring and held against it by `model_check`. Each relationship runs from the upstream
+# context that supplies to the downstream one that consumes. Every `attaches` is a conformist
+# relationship already (ADR 0155), so only what an attach cannot say is written here.
+Hecks.context_map "Hecks" do
+  context "Hecks"
+  context "Governance"
+  context "Bluebook"
+  context "Hecksagon"
+  context "World"
+  context "Adapter"
+  context "Port"
+  context "Translation"
+  context "Expression"
+  context "Tenancy"
+  context "Deploy"
+  context "Site"
+  context "Tickets"
+  context "Composer"
+  context "QualityControl"
+
+  # Deploy's `Tenant` is a validated request; Tenancy's `Tenant` is a fact. Tenancy's hecksagon
+  # translates Deploy's `TenantProvisioned` into its own `Register`, so Deploy's model never reaches it.
+  relate "Deploy" => "Tenancy", as: :anticorruption_layer
+end

data/lib/hecks/hecks/hecks.hecksagon

@@ -1,12 +1,12 @@
 Hecks.hecksagon "Hecks" do
   attaches "Governance"
 
-  # The chapters the gem carries: the language declared in itself (Paging comes with Bluebook),
+  # The bluebooks the gem carries: the language declared in itself (Paging comes with Bluebook),
   # Expression, Tenancy, Deploy, Site, Tickets, Composer and QualityControl (the last three bring their own ports).
   %w[Bluebook Hecksagon World Adapter Port Translation Expression Tenancy Deploy Site Tickets Composer QualityControl]
-    .each { |chapter| attaches chapter }
-  # Persistence is not bound here: hecks.world's `default_adapter` binds every aggregate, so
-  # environments/memory.world can swap the whole domain without a double bind.
+    .each { |declaration| attaches declaration }
+  # Persistence is not bound here, so the domain is in Memory. A copy opts in with a
+  # hecks.local.hecksagon whose `persisted_by` the attached bluebooks inherit (ADR 0136).
 
   # The outside a journaled Custodian command reaches: each port names what its adapter does,
   # and every ask is answered with the record's own arguments or refused with a reason.
@@ -31,6 +31,18 @@ Hecks.hecksagon "Hecks" do
       refuses "OperationRefused"
     end
 
+    asks "Redrive", to: Operation do
+      attribute :run, OperationKey
+      answers "OperationAnswered"
+      refuses "OperationRefused"
+    end
+
+    asks "Abandon", to: Operation do
+      attribute :run, OperationKey
+      answers "OperationAnswered"
+      refuses "OperationRefused"
+    end
+
     asks "Verify", to: Operation do
       attribute :run, OperationKey
       answers "OperationAnswered"
@@ -68,6 +80,97 @@ Hecks.hecksagon "Hecks" do
     end
   end
 
+  Hecks::PushTrain.port "Train" do
+    asks "Carry", to: PushTrain do
+      attribute :run, RunKey
+      answers "TrainAnswered"
+      refuses "TrainRefused"
+    end
+
+    asks "Tally", to: PushTrain do
+      attribute :run, RunKey
+      answers "SurveyAnswered"
+      refuses "SurveyRefused"
+    end
+  end
+
+  Hecks::PushTrain.port "Alerts" do
+    asks "Announce", to: PushTrain do
+      attribute :run, RunKey
+      answers "DeployReadyAnnounced"
+      refuses "AnnouncementRefused"
+    end
+  end
+
+  Hecks::Checkout.port "Reading" do
+    answers_query "Status"
+    answers_query "Changes"
+    answers_query "Log"
+  end
+
+  Hecks::Checkout.port "Settings" do
+    answers_query "Settings"
+  end
+
+  Hecks::Landing.port "Worktrees" do
+    asks "Merge", to: Landing do
+      attribute :run, RunKey
+      answers "MergeAnswered"
+      refuses "MergeRefused"
+    end
+
+    asks "Remove", to: Landing do
+      attribute :run, RunKey
+      answers "RemovalAnswered"
+      refuses "RemovalRefused"
+    end
+
+    answers_query "Unlanded"
+  end
+
+  # The outside an agent run reaches: it finds the directory, starts the background session, and
+  # reports the state the session is in. The state is judged in the bluebook, not here.
+  Hecks::AgentRun.port "Agents" do
+    asks "Locate", to: AgentRun do
+      attribute :run, RunKey
+      answers "RepoLocated"
+      refuses "RepoMissing"
+    end
+
+    asks "Start", to: AgentRun do
+      attribute :run, RunKey
+      answers "AgentStarted"
+      refuses "StartRefused"
+    end
+
+    asks "Examine", to: AgentRun do
+      attribute :run, RunKey
+      answers "SessionChecked"
+      refuses "CheckRefused"
+    end
+
+    # Whether a person took the session over is a fact about its transcript; the bluebook judges it.
+    asks "Review", to: AgentRun do
+      attribute :run, RunKey
+      answers "SessionReviewed"
+      refuses "ReviewRefused"
+    end
+
+    asks "Remove", to: AgentRun do
+      attribute :run, RunKey
+      answers "SessionRemoved"
+      refuses "RemoveRefused"
+    end
+  end
+
+  Hecks::PushTrain.port "Launcher" do
+    asks "Refresh", to: PushTrain do
+      attribute :run, RunKey
+      answers "LauncherRefreshed"
+      refuses "LauncherRefreshRefused"
+    end
+  end
+
   Hecks::Era.port "JournalStore" do
     asks "Examine", to: Era do
       attribute :run, RunKey
@@ -87,6 +190,22 @@ Hecks.hecksagon "Hecks" do
     answers_query "Compaction"
   end
 
+  Hecks::Era.port "Ledger" do
+    asks "Capture", to: Era do
+      attribute :run, RunKey
+      answers "HeadCaptured"
+      refuses "CaptureRefused"
+    end
+  end
+
+  Hecks::Audit.port "Ledger" do
+    asks "Walk", to: Audit do
+      attribute :run, AuditKey
+      answers "ChainWalked"
+      refuses "WalkRefused"
+    end
+  end
+
   Hecks::Package.port "Git" do
     asks "Pin", to: Package do
       attribute :package, PackageRef
@@ -120,6 +239,12 @@ Hecks.hecksagon "Hecks" do
       answers "LaunchAnswered"
       refuses "LaunchRefused"
     end
+
+    asks "WriteRails", to: Launch do
+      attribute :run, LaunchKey
+      answers "LaunchAnswered"
+      refuses "LaunchRefused"
+    end
   end
 
   Hecks::Launch.port "Terminal" do
@@ -315,6 +440,11 @@ Hecks.hecksagon "Hecks" do
       answers "InspectionAnswered"
       refuses "InspectionRefused"
     end
+
+    answers_query "Search"
+    answers_query "ReadSource"
+    answers_query "Outline"
+    answers_query "Declaration"
   end
 
   Hecks::CodemodRun.port "SourceTree" do
@@ -558,6 +688,9 @@ Hecks.hecksagon "Hecks" do
     answers_query "History"
     answers_query "Statements"
     answers_query "Narrate"
+    answers_query "Relationships"
+    answers_query "ContextMap"
+    answers_query "WorldSkeleton"
     answers_query "Docs"
     answers_query "ProjectDiagrams"
     answers_query "Glossary"
@@ -569,8 +702,8 @@ Hecks.hecksagon "Hecks" do
 end
 
 # The one seam where Deploy's "Tenant" (a validated request) becomes Tenancy's "Tenant" (a fact),
-# as tenancy.hecksagon declares it for the chapters booted on their own: `hecks deploy tenant.provision`
-# registers the tenant it provisioned. It sits here, after `attaches` has loaded both chapters.
+# as tenancy.hecksagon declares it for the bluebooks booted on their own: `hecks deploy tenant.provision`
+# registers the tenant it provisioned. It sits here, after `attaches` has loaded both bluebooks.
 Hecks.hecksagon "Tenancy" do
   translates "RegisterProvisionedTenant" do
     on Tenant::TenantProvisioned

data/lib/hecks/hecks/hecks.world

@@ -1,19 +1,21 @@
 # Where the Hecks domain keeps its journal: every command's events, one entry per aggregate.
 #
-# **PostgresEra** is the default, for real runs: a client's `hecks` and a maintainer's on main
-# or stable. The journal then survives the process, and `hecks stores` and
-# `hecks history` read it back. `default_adapter` binds every aggregate of the chapter (and of
-# the attached Governance chapter, see governance.world) in one line, which is what lets the
-# environments/memory.world overlay swap the whole domain to Memory.
+# **Memory** is the default, as for any hexagonal domain: neither this world nor hecks.hecksagon
+# names persistence, so the domain boots with nothing behind it and a run writes nothing it cannot
+# lose. Persistence is an opt-in, made in local files and never in these: a `hecks.local.hecksagon`
+# with `persisted_by "PostgresEra"` (the attached bluebooks inherit it) and a `hecks.local.world` with
+# the values, beside this file or in the working directory. `.gitignore` keeps them out of the
+# repository, so one copy persists without any other copy knowing. The copy that runs the push
+# train does this, and so does a client who wants `hecks stores` and `hecks history` to read a
+# journal back. A local world on a deployed box, whose password arrives at runtime, reads it with
+# `default_database ENV.fetch("HECKS_DATABASE")`; nothing here depends on that variable.
 #
-# **Memory** is for anything that must not touch a database: specs and pull-request runs.
-# Select it with `HECKS_ENVIRONMENT=memory` (Hecks.boot reads the variable) or
-# `Hecks.boot(path, environment: "memory")`. Queries and refused or dry-run requests record
-# nothing worth keeping, so they behave the same on either.
+# `HECKS_ENVIRONMENT=memory` (Hecks.boot reads the variable) or `Hecks.boot(path, environment:
+# "memory")` selects Memory even when local files name a store: specs and pull-request runs use
+# it. Queries and refused or dry-run requests record nothing worth keeping, so they behave the
+# same on either.
 #
-# The database is `HECKS_DATABASE` when set, so a client points the domain at their own
-# Postgres (a `postgres://` URL, or a bare database name); otherwise a local database named for
-# the domain. It connects as the ordinary role `hecks`, never a superuser: the era write-fence
+# A local world connects as the ordinary role `hecks`, never a superuser: the era write-fence
 # (row-level security) is bypassed by one, so boot refuses it. Create the role once with
 # `hecks quality_control sweep.create_ledger_role hecks` and the database with `createdb -O hecks hecks`.
 #
@@ -28,20 +30,18 @@
 # refusal is an exit status and a reason on standard error (`package.vendor`, which a script runs
 # for its outcome), `unknown_runs` names the questions about one run that refuse a run the process
 # does not hold, as unknown, not as an empty list (`rehearsal_run.rehearsal_outcome`: a run is kept
-# by the process that made it, so `request` waits and prints the whole outcome), `executable` is where `hecks project_cli` writes this chapter's launcher (the
+# by the process that made it, so `request` waits and prints the whole outcome), `executable` is where `hecks project_cli` writes this bluebook's launcher (the
 # gem's `exe/hecks`), `streams` lists the questions `--stream` may tail (`Follow`), `memory_commands` names
 # the commands that launcher runs on the Memory environment unless `HECKS_ENVIRONMENT` is set (so
 # `hecks console` needs no database), and `legacy` names the commands it hands to `Hecks::CLI` in the
 # positional forms ADR 0066 shipped. `maintainer` names the aggregates only someone working on a hecks
 # checkout runs (Codebase, and releasing hecks itself): the help leaves them out anywhere else and
-# `--maintainer` lists them; `chapters` names the attached chapters the help points at, one line each
-# (`hecks deploy`), and `maintainer_chapters` the language's own, added inside a checkout.
+# `--maintainer` lists them; `bluebooks` names the attached bluebooks the help points at, one line each
+# (`hecks deploy`), and `maintainer_bluebooks` the language's own, added inside a checkout.
 # `newcomer` names the only commands the help lists in a folder holding no bluebook yet
 # (`hecks --all` lists the rest), so a first run shows how to start and nothing else.
 Hecks.world "Hecks" do
   realm "Hecks"
-  default_adapter "PostgresEra"
-  default_database ENV.fetch("HECKS_DATABASE", "postgres://hecks@localhost/hecks")
   launcher "Launcher", run_keys: true,
                        settled: %w[package.vendor package.revendor package.release
                                   operation.bootstrap_admin smoke_run.run
@@ -49,9 +49,10 @@ Hecks.world "Hecks" do
                                   data_copy.verify bluebook_diff.run preview_run.name
                                   preview_run.url preview_run.list preview_run.deploy
                                   preview_run.destroy preview_run.login companion_roll.run
-                                  handover.clear rehearsal_run.request],
+                                  handover.clear rehearsal_run.request push_train.board
+                                  landing.land landing.retire agent_run.dispatch agent_run.check],
                        unknown_runs: %w[rehearsal_run.rehearsal_outcome],
-                       names: { "mcp" => "launch.serve_mcp", "console" => "operation.open_console", "init" => "launch.init",
+                       names: { "config" => "checkout.settings", "mcp" => "launch.serve_mcp", "console" => "operation.open_console", "init" => "launch.init",
                                 "interview" => "launch.interview", "package.check" => "registry.check",
                                 "package.digest" => "registry.digest",
                                 "package.release" => "registry.release" },
@@ -61,8 +62,8 @@ Hecks.world "Hecks" do
                                       CodemodRun TestSuiteRun CorpusRun PublishingRun PromotionRun Release
                                       SyntaxBootCache],
                        newcomer: %w[launch.init launch.interview operation.open_console],
-                       chapters: %w[Deploy Governance Tenancy Site Tickets Composer QualityControl],
-                       maintainer_chapters: %w[Bluebook Hecksagon World Adapter Port Translation Expression],
+                       bluebooks: %w[Deploy Governance Tenancy Site Tickets Composer QualityControl],
+                       maintainer_bluebooks: %w[Bluebook Hecksagon World Adapter Port Translation Expression],
                        memory_commands: %w[console init interview],
                        legacy: %w[run docs narrate ir stores model_check smoke_test
                                   project_diagrams project_cli mcp]

data/lib/hecks/hecks/ledger.bluebook

@@ -0,0 +1,190 @@
+Hecks.bluebook "Hecks" do
+  # Ledger: a journal that proves it was not rewritten. A seal records the head a journal chain has,
+  # kept beside the journal itself; an Audit recomputes the chain from the seals and compares. Compaction
+  # is the one sanctioned way rows leave a journal, so it seals first: the capture is one ask on the Era
+  # being changed (the reaction depth is bounded, so the seal cannot be a chain of its own), and a
+  # compaction whose head cannot be captured is abandoned, not applied.
+
+  aggregate "Seal" do
+    description "The head a domain's journal chain had when the rows before it were compacted away."
+
+    attribute :run,      SealKey
+    attribute :domain,   Domain
+    attribute :through,  Ordinal
+    attribute :head,     ChainDigest
+    attribute :previous, ChainDigest
+    identified_by :run
+
+    value_object "SealKey" do
+      attribute :value, String, matches: :present
+
+      invariant("a seal is named") { !value.to_s.empty? }
+    end
+
+    # The domain whose journal is sealed: its directory.
+    value_object "Domain" do
+      attribute :value, String, matches: :not_empty
+    end
+
+    # The last journal ordinal the seal covers.
+    value_object "Ordinal" do
+      attribute :value, Integer
+
+      invariant("a seal covers at least one row") { value > 0 }
+    end
+
+    # A SHA-256 digest, lowercase hexadecimal.
+    value_object "ChainDigest" do
+      attribute :value, String, pattern: '^[0-9a-f]{64}$'
+    end
+
+    # `previous` is the head of the seal before this one, so seals chain too; the first seal
+    # of a domain carries the genesis digest, sixty-four zeros.
+    command "Record" do
+      role "System"
+      goal "Keep the head the chain had, and the seal it followed"
+
+      attribute :domain,   Domain, sets: true
+      attribute :run,      SealKey, sets: true
+      attribute :through,  Ordinal, sets: true
+      attribute :head,     ChainDigest, sets: true
+      attribute :previous, ChainDigest, sets: true
+
+
+      emits SealRecorded
+    end
+
+    query "Latest" do
+      description "The newest seal a domain holds."
+      attribute :domain, Domain
+      where(domain: :domain)
+      order_by :through
+    end
+
+  end
+
+  aggregate "Audit" do
+    description "One walk of a domain's journal chain from its latest seal, and whether every digest held."
+
+    attribute :run,       AuditKey
+    attribute :domain,    AuditedDomain
+    attribute :checked,   Count,   optional: true
+    attribute :report,    Finding, optional: true
+    identified_by :run
+
+    value_object "AuditKey" do
+      attribute :value, String, matches: :present
+
+      invariant("an audit is named") { !value.to_s.empty? }
+    end
+
+    value_object "AuditedDomain" do
+      attribute :value, String, matches: :not_empty
+    end
+
+    value_object "Count" do
+      attribute :value, Integer
+    end
+
+    value_object "Finding" do
+      attribute :value, String
+    end
+
+    lifecycle :status, default: "requested" do
+      mark :failure, "unproven"
+      transition "Confirm" => "verified", from: "requested"
+      transition "Fail"    => "unproven", from: "requested"
+      mark :terminal, "unproven", "verified"
+    end
+
+    command "Verify" do
+      role "Auditor"
+      goal "Walk a domain's journal chain from its latest seal and say whether it was altered"
+
+      attribute :domain, AuditedDomain, sets: true
+      attribute :run,    AuditKey, sets: true
+
+
+      emits VerificationRequested
+    end
+
+    command "Confirm" do
+      role "System"
+      goal "Record that every row's digest held, and how many were checked"
+
+      reference_to Audit
+      attribute :checked, Count, sets: true
+      attribute :report,  Finding, sets: true
+
+      given("the walk checked a row") { checked.value > 0 }
+
+
+      emits ChainConfirmed
+    end
+
+    # A chain that cannot be shown intact is unproven, whether a digest failed or the walk could not
+    # run; the report names the row or the reason.
+    command "Fail" do
+      role "System"
+      goal "Record that the chain could not be shown intact, and why"
+
+      reference_to Audit
+      attribute :report, Finding, sets: true
+
+
+      emits ChainUnproven
+    end
+
+    query "Verdict" do
+      description "What one audit found."
+      attribute :run, AuditKey
+      where(run: :run)
+      order_by :run
+    end
+
+    query "Unproven" do
+      description "Every audit that could not show the chain intact."
+      where(status: "unproven")
+      order_by :run
+    end
+  end
+
+  # A compaction is applied only once the head it would erase is sealed.
+  policy "CaptureWhenCompactionPermitted" do
+    on      "Era.EraPermitted"
+    where do
+      operation.value == "compact" || operation.value == "compact_heki"
+    end
+    ask     :capture, with: { run: :run }
+  end
+
+  policy "RecordTheSeal" do
+    on      "Era.HeadCaptured"
+    trigger Seal::Record, with: { run: :run, domain: :domain, through: :through, head: :head, previous: :previous }
+  end
+
+  policy "CompactWhenSealed" do
+    on      "Era.HeadCaptured"
+    ask     :apply, with: { run: :run }
+  end
+
+  policy "AbandonWhenNotSealed" do
+    on      "Era.CaptureRefused"
+    trigger Era::Abandon, with: { refusal: :refusal }
+  end
+
+  policy "WalkWhenVerificationRequested" do
+    on      "Audit.VerificationRequested"
+    ask     :walk, with: { run: :run }
+  end
+
+  policy "ConfirmWhenChainWalked" do
+    on      "Audit.ChainWalked"
+    trigger Audit::Confirm, with: { checked: :checked, report: :report }
+  end
+
+  policy "FailWhenWalkRefused" do
+    on      "Audit.WalkRefused"
+    trigger Audit::Fail, with: { report: :refusal }
+  end
+end