hecks 5.0.0 → 7.0.0

data/rust/host/{src → core/src}/lambda_client.rs

@@ -1,9 +1,10 @@
 //! Delivers a `PendingCrossDomainReaction` to another domain's Lambda function,
-//! mirroring `Adapters::Lambda::Client`'s invoke/dispatch shape.
+//! mirroring `Adapters::Lambda::Client`'s invoke/dispatch shape. This is the port; the AWS
+//! adapter behind it is `aws_lambda_invoker`.
 
 use serde_json::Value;
 
-// Decoupled from `aws_sdk_lambda`'s own response type so a mock never needs one.
+// Decoupled from the AWS SDK's own response type so a mock never needs one.
 pub struct InvokeOutcome {
     pub body: Value,
     pub function_error: bool,
@@ -185,37 +186,12 @@ pub async fn deliver_with_retry<L: LambdaInvoker + ?Sized>(
     })
 }
 
-// Untestable here — needs a real deployed Lambda and live AWS credentials,
-// neither of which this repository's test environment has.
-pub struct AwsLambdaInvoker {
-    client: aws_sdk_lambda::Client,
-}
-
-impl AwsLambdaInvoker {
-    // Explicit rustls+ring HTTP client — neither crate's own default feature
-    // actually wires in `ring` (see Cargo.toml's note on this dependency).
-    pub async fn from_env() -> Self {
-        let http_client = aws_smithy_http_client::Builder::new()
-            .tls_provider(aws_smithy_http_client::tls::Provider::Rustls(
-                aws_smithy_http_client::tls::rustls_provider::CryptoMode::Ring,
-            ))
-            .build_https();
-        let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
-            .http_client(http_client)
-            .load()
-            .await;
-        Self {
-            client: aws_sdk_lambda::Client::new(&config),
-        }
-    }
-}
-
 // Panics if invoked — asserts that same-domain-only test suites never
 // trigger a cross-domain delivery.
-#[cfg(test)]
+#[cfg(any(test, feature = "test-support"))]
 pub struct NeverInvoker;
 
-#[cfg(test)]
+#[cfg(any(test, feature = "test-support"))]
 #[async_trait::async_trait]
 impl LambdaInvoker for NeverInvoker {
     async fn invoke(&self, function_name: &str, _payload: &str) -> anyhow::Result<InvokeOutcome> {
@@ -223,34 +199,6 @@ impl LambdaInvoker for NeverInvoker {
     }
 }
 
-#[async_trait::async_trait]
-impl LambdaInvoker for AwsLambdaInvoker {
-    async fn invoke(&self, function_name: &str, payload: &str) -> anyhow::Result<InvokeOutcome> {
-        let response = self
-            .client
-            .invoke()
-            .function_name(function_name)
-            .payload(aws_sdk_lambda::primitives::Blob::new(payload.as_bytes()))
-            .send()
-            .await
-            .map_err(|e| anyhow::anyhow!("invoking Lambda {function_name}: {e:?}"))?;
-
-        let function_error = response.function_error().is_some();
-        let bytes = response
-            .payload()
-            .map(|blob| blob.as_ref().to_vec())
-            .unwrap_or_default();
-        // A non-JSON/empty body reads as `{}` rather than failing the call;
-        // `function_error` (checked above) is what actually signals a fault.
-        let body: Value = serde_json::from_slice(&bytes).unwrap_or_else(|_| serde_json::json!({}));
-
-        Ok(InvokeOutcome {
-            body,
-            function_error,
-        })
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -269,7 +217,7 @@ mod tests {
     // all four Ruby copies of the formula, so a drift in any of them fails a test.
     fn stack_name_vectors() -> Value {
         serde_json::from_str(include_str!(
-            "../../../spec/fixtures/stack_name_vectors.json"
+            "../../../../spec/fixtures/stack_name_vectors.json"
         ))
         .unwrap()
     }
@@ -348,12 +296,9 @@ mod tests {
     async fn delivers_and_invokes_the_computed_function_name_with_the_verb_args_payload_shape() {
         let invoker = MockLambdaInvoker::answering(serde_json::json!({ "refusals": [] }), false);
 
-        let record = deliver(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await
-        .unwrap();
+        let record = deliver(&invoker, &reaction("Compliance", "Compliance::Review.Open"))
+            .await
+            .unwrap();
 
         assert!(record.delivered);
         assert_eq!(record.reason, None);
@@ -364,23 +309,20 @@ mod tests {
         let (function_name, payload) = &calls[0];
         assert_eq!(function_name, "hecks-compliance");
         let sent: Value = serde_json::from_str(payload).unwrap();
-        assert_eq!(sent["verb"], "Compliance::AccountFreezeReview.Open");
+        assert_eq!(sent["verb"], "Compliance::Review.Open");
         assert_eq!(sent["args"]["number"]["value"], "acct-1");
     }
 
     #[tokio::test]
     async fn a_target_side_refusal_is_recorded_non_fatally_not_raised() {
         let invoker = MockLambdaInvoker::answering(
-            serde_json::json!({ "refusals": [ { "verb": "Compliance::AccountFreezeReview.Open", "error": "already under review" } ] }),
+            serde_json::json!({ "refusals": [ { "verb": "Compliance::Review.Open", "error": "already under review" } ] }),
             false,
         );
 
-        let record = deliver(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await
-        .unwrap();
+        let record = deliver(&invoker, &reaction("Compliance", "Compliance::Review.Open"))
+            .await
+            .unwrap();
 
         assert!(!record.delivered);
         assert_eq!(record.reason.as_deref(), Some("already under review"));
@@ -395,12 +337,9 @@ mod tests {
             false,
         );
 
-        let record = deliver(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await
-        .unwrap();
+        let record = deliver(&invoker, &reaction("Compliance", "Compliance::Review.Open"))
+            .await
+            .unwrap();
 
         assert!(record.delivered);
     }
@@ -414,11 +353,7 @@ mod tests {
             true,
         );
 
-        let outcome = deliver(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await;
+        let outcome = deliver(&invoker, &reaction("Compliance", "Compliance::Review.Open")).await;
 
         assert!(
             outcome.is_err(),
@@ -478,12 +413,10 @@ mod tests {
     async fn deliver_with_retry_rides_out_a_transient_fault_that_clears_before_attempts_run_out() {
         let invoker = FlakyLambdaInvoker::failing_then_succeeding(MAX_DELIVERY_ATTEMPTS - 1);
 
-        let record = deliver_with_retry(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await
-        .expect("should succeed once the fault clears, within MAX_DELIVERY_ATTEMPTS");
+        let record =
+            deliver_with_retry(&invoker, &reaction("Compliance", "Compliance::Review.Open"))
+                .await
+                .expect("should succeed once the fault clears, within MAX_DELIVERY_ATTEMPTS");
 
         assert!(record.delivered);
         assert_eq!(
@@ -498,16 +431,14 @@ mod tests {
         // A clean refusal is `Ok(delivered: false)`, a business decision — retrying
         // it would not change what the target domain decided.
         let invoker = MockLambdaInvoker::answering(
-            serde_json::json!({ "refusals": [ { "verb": "Compliance::AccountFreezeReview.Open", "error": "already under review" } ] }),
+            serde_json::json!({ "refusals": [ { "verb": "Compliance::Review.Open", "error": "already under review" } ] }),
             false,
         );
 
-        let record = deliver_with_retry(
-            &invoker,
-            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
-        )
-        .await
-        .expect("a domain-side refusal is Ok, not a DeliveryFailure");
+        let record =
+            deliver_with_retry(&invoker, &reaction("Compliance", "Compliance::Review.Open"))
+                .await
+                .expect("a domain-side refusal is Ok, not a DeliveryFailure");
 
         assert!(!record.delivered);
         assert_eq!(

data/rust/host/core/src/lib.rs

@@ -0,0 +1,37 @@
+//! The host's runtime, free of any driver: dispatch, the journal's data, the [`store::Store`] and
+//! its [`store::Backend`] trait, the IR, the expression engine and the presentation code.
+//!
+//! The adapters crate (`rust_host`) implements the backends and the transports on top of this.
+//! Nothing in this crate's dependency table can open a connection or a socket, so a leak of a
+//! driver into the runtime is a compile error rather than a convention.
+
+pub mod arg_limits;
+pub mod clock;
+pub mod dispatch;
+pub mod expr_json;
+// Generated: its static regexes are literals that compile, and the generator always emits
+// `r#"…"#`, so the lints below are allowed here.
+#[allow(clippy::expect_used, clippy::needless_raw_string_hashes)]
+pub mod field_hints;
+pub mod host;
+// The one `Hecks::Naming` port, compiled from `hecks-codegen`'s source: the host and the codegen
+// are independent Cargo projects, so the file is shared by path rather than by dependency.
+#[allow(dead_code)]
+#[path = "../../../codegen/src/hecks_naming.rs"]
+pub mod hecks_naming;
+pub mod ir;
+pub mod journal;
+pub mod lambda_client;
+pub mod log;
+pub mod needs;
+pub mod plugins;
+pub mod presentation;
+pub mod presentation_write;
+pub mod query_step;
+pub mod reference_transform;
+pub mod reference_validate;
+pub mod storage_shape;
+pub mod store;
+pub mod ui_schema;
+pub mod validation;
+pub mod wasm_runner;

data/rust/host/{src → core/src}/needs.rs

@@ -1,7 +1,8 @@
 // Facts a command `needs` (ADR 0081): the host answers them before the kernel reads the arguments,
 // the way the Ruby interpreter does in `decode_arguments`. The command's own IR carries
 // `"needs": [{"fact": "now"}]`; a needed fact the caller left out is filled with the clock's
-// answer, a supplied one is kept. The answer is written into the arguments before they are
+// answer, a supplied one is kept, except on a request from outside the host (`answer_needs`), where
+// the clock's answer replaces it. The answer is written into the arguments before they are
 // journaled, so a replay re-dispatches the recorded value rather than asking the clock again.
 
 use serde_json::{json, Value};
@@ -25,10 +26,10 @@ impl Clock for SystemClock {
 }
 
 /// A clock that always answers one moment, for tests.
-#[cfg(test)]
+#[cfg(any(test, feature = "test-support"))]
 pub struct FixedClock(pub i64);
 
-#[cfg(test)]
+#[cfg(any(test, feature = "test-support"))]
 impl Clock for FixedClock {
     fn now_secs(&self) -> i64 {
         self.0
@@ -274,12 +275,35 @@ fn answer(fact: &str, attribute_type: Option<&str>, clock: &dyn Clock) -> Option
 /// the caller supplied (even a null) is kept; a command that needs nothing is untouched.
 pub fn fill_needs(domain_ir: &Value, verb: &str, args: &mut Value, clock: &dyn Clock) {
     let needs = declared_needs(domain_ir, verb);
-    if needs.is_empty() {
-        return;
+    if let Some(facts) = facts_mut(args) {
+        fill(needs, facts, clock, Supplied::Kept);
     }
-    let Some(facts) = facts_mut(args) else { return };
+}
+
+/// Answers every fact `verb` needs from the clock, replacing any value `args` carries for it: a
+/// request from outside the host may not say what time it is.
+pub fn answer_needs(domain_ir: &Value, verb: &str, args: &mut Value, clock: &dyn Clock) {
+    let needs = declared_needs(domain_ir, verb);
+    if let Some(facts) = facts_mut(args) {
+        fill(needs, facts, clock, Supplied::Replaced);
+    }
+}
+
+/// What happens to a needed fact the caller already supplied.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Supplied {
+    Kept,
+    Replaced,
+}
+
+fn fill(
+    needs: Vec<(&str, Option<&str>)>,
+    facts: &mut serde_json::Map<String, Value>,
+    clock: &dyn Clock,
+    supplied: Supplied,
+) {
     for (fact, attribute_type) in needs {
-        if facts.contains_key(fact) {
+        if supplied == Supplied::Kept && facts.contains_key(fact) {
             continue;
         }
         if let Some(value) = answer(fact, attribute_type, clock) {
@@ -328,19 +352,17 @@ fn declared_query_needs<'a>(
 /// arguments are not an object, is untouched.
 pub fn fill_query_needs(domain_ir: &Value, question: &str, args: &mut Value, clock: &dyn Clock) {
     let needs = declared_query_needs(domain_ir, question);
-    if needs.is_empty() {
-        return;
+    if let Some(facts) = args.as_object_mut() {
+        fill(needs, facts, clock, Supplied::Kept);
     }
-    let Some(facts) = args.as_object_mut() else {
-        return;
-    };
-    for (fact, attribute_type) in needs {
-        if facts.contains_key(fact) {
-            continue;
-        }
-        if let Some(value) = answer(fact, attribute_type, clock) {
-            facts.insert(fact.to_string(), value);
-        }
+}
+
+/// Answers every fact the query `question` needs from the clock, replacing any value `args`
+/// carries for it, as `answer_needs` does for a command.
+pub fn answer_query_needs(domain_ir: &Value, question: &str, args: &mut Value, clock: &dyn Clock) {
+    let needs = declared_query_needs(domain_ir, question);
+    if let Some(facts) = args.as_object_mut() {
+        fill(needs, facts, clock, Supplied::Replaced);
     }
 }
 
@@ -364,7 +386,7 @@ pub fn fill_defaults(domain_ir: &Value, verb: &str, args: &mut Value) {
 mod tests {
     use super::*;
 
-    const LEASE_IR: &str = include_str!("../../src/generated/lease_clock/ir.json");
+    const LEASE_IR: &str = include_str!("../../../src/generated/lease_clock/ir.json");
 
     fn lease_ir() -> Value {
         serde_json::from_str(LEASE_IR).unwrap()
@@ -432,6 +454,18 @@ mod tests {
         assert_eq!(args["with"]["now"], json!({"value": 42}));
     }
 
+    #[test]
+    fn a_request_from_outside_the_host_cannot_set_the_clock() {
+        let ir = lease_ir();
+        let mut args = json!({"with": {"now": {"value": 42}, "holder": "a"}});
+        answer_needs(&ir, &first_needing(&ir), &mut args, &FixedClock(7));
+        assert_eq!(args["with"]["now"], json!({"value": 7}));
+        assert_eq!(args["with"]["holder"], "a");
+        let mut null = json!({"now": null});
+        answer_needs(&ir, &first_needing(&ir), &mut null, &FixedClock(7));
+        assert_eq!(null["now"], json!({"value": 7}));
+    }
+
     #[test]
     fn a_command_with_no_needs_is_untouched() {
         let ir = integer_ir();
@@ -607,6 +641,18 @@ mod tests {
         assert_eq!(named["now"], json!({"value": 9}));
     }
 
+    #[test]
+    fn a_query_from_outside_the_host_cannot_set_the_clock() {
+        let mut args = json!({"now": {"value": 9}});
+        answer_query_needs(
+            &query_ir(),
+            "Lease::Slot.Expired",
+            &mut args,
+            &FixedClock(5),
+        );
+        assert_eq!(args["now"], json!({"value": 5}));
+    }
+
     #[test]
     fn a_query_that_needs_nothing_or_names_nothing_is_untouched() {
         let mut args = json!({});

data/rust/host/core/src/plugins.rs

@@ -0,0 +1,269 @@
+//! Wasm plugins: queries a package answers with its own module (the IR's `plugins` key), the
+//! same module the Ruby runtime runs. A plugin is a WASI command, like the kernel: one question
+//! as JSON on stdin, `{"question", "args"}`, and one answer as JSON on stdout, `{"rows"}` or
+//! `{"refused"}`. A `reference_to` argument reaches it as the state of the record it names, read
+//! from current state here, so the plugin never reaches the store.
+//!
+//! The module rides in the IR (base64, with its SHA-256), so every deploy that ships the IR ships
+//! the plugin; it is written once to a cache file named by its digest and compiled once, by
+//! `wasm_runner`'s per-path cache.
+
+use crate::store::Store;
+use crate::{dispatch, wasm_runner};
+use base64::Engine as _;
+use serde_json::{json, Map, Value};
+use sha2::{Digest, Sha256};
+use std::path::{Path, PathBuf};
+
+/// One question a plugin answers, and what the host needs to ask it.
+#[derive(Debug, PartialEq, Eq)]
+pub struct PluginQuery {
+    pub adapter: String,
+    pub question: String,
+    /// Each `reference_to` argument, by name, with the qualified aggregate it names.
+    pub references: Vec<(String, String)>,
+    pub sha256: String,
+}
+
+/// The plugin that answers a qualified question, if the IR names one.
+pub fn answering(domain_ir: Option<&Value>, question: &str) -> Option<PluginQuery> {
+    let plugins = domain_ir?.get("plugins")?.as_array()?;
+    plugins.iter().find_map(|plugin| {
+        let query = plugin
+            .get("queries")?
+            .as_array()?
+            .iter()
+            .find(|q| q["question"] == question)?;
+        let references = query
+            .get("references")
+            .and_then(|r| r.as_object())
+            .map(|r| {
+                r.iter()
+                    .filter_map(|(arg, agg)| Some((arg.clone(), agg.as_str()?.to_string())))
+                    .collect()
+            })
+            .unwrap_or_default();
+        Some(PluginQuery {
+            adapter: plugin.get("adapter")?.as_str()?.to_string(),
+            question: question.to_string(),
+            references,
+            sha256: plugin.get("sha256")?.as_str()?.to_string(),
+        })
+    })
+}
+
+/// Asks the plugin, each referenced record replaced by its current state, and shapes the answer
+/// as the kernel shapes a query's: rows on success, a refusal otherwise.
+pub async fn answer(
+    plugin: &PluginQuery,
+    domain_ir: &Value,
+    args: Value,
+    store: &Store,
+    wasm_path: &Path,
+) -> Result<Value, String> {
+    let module = module_path(domain_ir, plugin)?;
+    let mut asked_with = args.as_object().cloned().unwrap_or_default();
+    if !plugin.references.is_empty() {
+        let current = dispatch::read(store, wasm_path)
+            .await
+            .map_err(|e| format!("{e:#}"))?;
+        if let Err(missing) =
+            resolve_references(&plugin.references, &current["instances"], &mut asked_with)
+        {
+            return Ok(refusal(&plugin.question, &args, "NotFound", &missing));
+        }
+    }
+    let input = json!({ "question": plugin.question, "args": asked_with }).to_string();
+    let output = tokio::task::spawn_blocking(move || wasm_runner::run(&module, &input))
+        .await
+        .map_err(|e| e.to_string())?
+        .map_err(|e| format!("{} failed: {e:#}", plugin.adapter))?;
+    let reply: Value = serde_json::from_str(&output).map_err(|e| {
+        format!(
+            "{} answered with text that is not JSON: {e}",
+            plugin.adapter
+        )
+    })?;
+    if let Some(rows) = reply.get("rows") {
+        return Ok(json!({
+            "instances": {},
+            "events": [],
+            "refusals": [],
+            "queries": [{ "query": plugin.question, "args": args, "rows": rows }],
+        }));
+    }
+    reply.get("refused").and_then(|r| r.as_str()).map_or_else(
+        || {
+            Err(format!(
+                "{} answered {} with neither rows nor a refusal",
+                plugin.adapter, plugin.question
+            ))
+        },
+        |why| {
+            let message = format!("{}: {why}", plugin.question);
+            Ok(refusal(&plugin.question, &args, "PluginRefusal", &message))
+        },
+    )
+}
+
+/// Replaces each reference argument's id with the state of the record it names, its id beside
+/// its fields, as the Ruby runtime hands it over.
+///
+/// @return Err naming the first reference whose record is not there
+pub fn resolve_references(
+    references: &[(String, String)],
+    instances: &Value,
+    args: &mut Map<String, Value>,
+) -> Result<(), String> {
+    for (argument, aggregate) in references {
+        let Some(id) = args
+            .get(argument)
+            .and_then(|v| v.as_str())
+            .map(str::to_string)
+        else {
+            continue;
+        };
+        let short = aggregate.rsplit("::").next().unwrap_or(aggregate);
+        let mut state = instances
+            .get(format!("{aggregate}#{id}"))
+            .and_then(|s| s.as_object())
+            .cloned()
+            .ok_or_else(|| format!("{argument}: no {short} {id:?}"))?;
+        state.insert("id".to_string(), Value::String(id));
+        args.insert(argument.clone(), Value::Object(state));
+    }
+    Ok(())
+}
+
+fn refusal(question: &str, args: &Value, kind: &str, message: &str) -> Value {
+    crate::query_step::refusal_result(question, args, kind, message)
+}
+
+/// Writes the plugin's module to a cache file named by its digest, once, and answers its path.
+fn module_path(domain_ir: &Value, plugin: &PluginQuery) -> Result<PathBuf, String> {
+    let path = plugin_dir().join(format!("{}.wasm", plugin.sha256));
+    if path.exists() {
+        return Ok(path);
+    }
+    let encoded = domain_ir["plugins"]
+        .as_array()
+        .and_then(|all| all.iter().find(|p| p["adapter"] == plugin.adapter.as_str()))
+        .and_then(|p| p["module"].as_str())
+        .ok_or_else(|| format!("the IR carries no module for {}", plugin.adapter))?;
+    let bytes = base64::engine::general_purpose::STANDARD
+        .decode(encoded)
+        .map_err(|e| format!("{}'s module is not base64: {e}", plugin.adapter))?;
+    let digest = hex(&Sha256::digest(&bytes));
+    if digest != plugin.sha256 {
+        return Err(format!(
+            "{}'s module does not match its digest",
+            plugin.adapter
+        ));
+    }
+    std::fs::create_dir_all(plugin_dir()).map_err(|e| e.to_string())?;
+    // Written beside and renamed, so a concurrent reader never compiles a partial module.
+    let partial = path.with_extension(format!("{}.partial", std::process::id()));
+    std::fs::write(&partial, &bytes).map_err(|e| e.to_string())?;
+    std::fs::rename(&partial, &path).map_err(|e| e.to_string())?;
+    Ok(path)
+}
+
+/// Where modules are written, one file per digest.
+fn plugin_dir() -> PathBuf {
+    std::env::temp_dir().join("hecks-plugins")
+}
+
+fn hex(bytes: &[u8]) -> String {
+    use std::fmt::Write as _;
+    bytes.iter().fold(String::new(), |mut out, byte| {
+        let _ = write!(out, "{byte:02x}");
+        out
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DOUBLER: &[u8] = include_bytes!("../../../../spec/fixtures/wasm_plugin/doubler.wasm");
+
+    fn ir() -> Value {
+        json!({
+            "plugins": [{
+                "adapter": "Doubler",
+                "runs": "doubler.wasm",
+                "queries": [
+                    { "question": "Pluginned::Ledger.Doubled", "references": { "entry": "Pluginned::Ledger" } },
+                    { "question": "Pluginned::Ledger.Tripled", "references": {} }
+                ],
+                "sha256": hex(&Sha256::digest(DOUBLER)),
+                "module": base64::engine::general_purpose::STANDARD.encode(DOUBLER),
+            }]
+        })
+    }
+
+    #[test]
+    fn finds_the_plugin_answering_a_question_and_its_references() {
+        let ir = ir();
+        let found = answering(Some(&ir), "Pluginned::Ledger.Doubled").unwrap();
+        assert_eq!(found.adapter, "Doubler");
+        assert_eq!(
+            found.references,
+            vec![("entry".to_string(), "Pluginned::Ledger".to_string())]
+        );
+        assert!(answering(Some(&ir), "Pluginned::Ledger.Halved").is_none());
+        assert!(answering(None, "Pluginned::Ledger.Doubled").is_none());
+    }
+
+    #[test]
+    fn hands_a_reference_over_as_the_record_state_with_its_id() {
+        let instances = json!({ "Pluginned::Ledger#house": { "name": { "value": "house" }, "note": { "value": "rent" } } });
+        let mut args = json!({ "entry": "house", "amount": 21 })
+            .as_object()
+            .cloned()
+            .unwrap();
+        let references = vec![("entry".to_string(), "Pluginned::Ledger".to_string())];
+
+        resolve_references(&references, &instances, &mut args).unwrap();
+
+        assert_eq!(
+            args["entry"],
+            json!({ "name": { "value": "house" }, "note": { "value": "rent" }, "id": "house" })
+        );
+        let mut missing = json!({ "entry": "nowhere" }).as_object().cloned().unwrap();
+        assert_eq!(
+            resolve_references(&references, &instances, &mut missing),
+            Err("entry: no Ledger \"nowhere\"".to_string())
+        );
+    }
+
+    #[test]
+    fn runs_the_same_module_the_ruby_runtime_runs() {
+        let ir = ir();
+        let plugin = answering(Some(&ir), "Pluginned::Ledger.Doubled").unwrap();
+        let module = module_path(&ir, &plugin).unwrap();
+        let input = json!({
+            "question": "Pluginned::Ledger.Doubled",
+            "args": { "amount": 21, "entry": { "note": { "value": "rent" }, "id": "house" } }
+        });
+
+        let output = wasm_runner::run(&module, &input.to_string()).unwrap();
+
+        assert_eq!(
+            serde_json::from_str::<Value>(&output).unwrap(),
+            json!({ "rows": [{ "amount": 42, "note": "rent" }] })
+        );
+    }
+
+    #[test]
+    fn refuses_a_module_that_does_not_match_its_digest() {
+        let mut ir = ir();
+        ir["plugins"][0]["sha256"] = json!("0".repeat(64));
+        let plugin = answering(Some(&ir), "Pluginned::Ledger.Doubled").unwrap();
+
+        assert_eq!(
+            module_path(&ir, &plugin),
+            Err("Doubler's module does not match its digest".to_string())
+        );
+    }
+}