hecks 6.0.0 → 7.0.0

data/lib/hecks/hecks/ledger.bluebook

@@ -1,190 +0,0 @@
-Hecks.bluebook "Hecks" do
-  # Ledger: a journal that proves it was not rewritten. A seal records the head a journal chain has,
-  # kept beside the journal itself; an Audit recomputes the chain from the seals and compares. Compaction
-  # is the one sanctioned way rows leave a journal, so it seals first: the capture is one ask on the Era
-  # being changed (the reaction depth is bounded, so the seal cannot be a chain of its own), and a
-  # compaction whose head cannot be captured is abandoned, not applied.
-
-  aggregate "Seal" do
-    description "The head a domain's journal chain had when the rows before it were compacted away."
-
-    attribute :run,      SealKey
-    attribute :domain,   Domain
-    attribute :through,  Ordinal
-    attribute :head,     ChainDigest
-    attribute :previous, ChainDigest
-    identified_by :run
-
-    value_object "SealKey" do
-      attribute :value, String, matches: :present
-
-      invariant("a seal is named") { !value.to_s.empty? }
-    end
-
-    # The domain whose journal is sealed: its directory.
-    value_object "Domain" do
-      attribute :value, String, matches: :not_empty
-    end
-
-    # The last journal ordinal the seal covers.
-    value_object "Ordinal" do
-      attribute :value, Integer
-
-      invariant("a seal covers at least one row") { value > 0 }
-    end
-
-    # A SHA-256 digest, lowercase hexadecimal.
-    value_object "ChainDigest" do
-      attribute :value, String, pattern: '^[0-9a-f]{64}$'
-    end
-
-    # `previous` is the head of the seal before this one, so seals chain too; the first seal
-    # of a domain carries the genesis digest, sixty-four zeros.
-    command "Record" do
-      role "System"
-      goal "Keep the head the chain had, and the seal it followed"
-
-      attribute :domain,   Domain, sets: true
-      attribute :run,      SealKey, sets: true
-      attribute :through,  Ordinal, sets: true
-      attribute :head,     ChainDigest, sets: true
-      attribute :previous, ChainDigest, sets: true
-
-
-      emits SealRecorded
-    end
-
-    query "Latest" do
-      description "The newest seal a domain holds."
-      attribute :domain, Domain
-      where(domain: :domain)
-      order_by :through
-    end
-
-  end
-
-  aggregate "Audit" do
-    description "One walk of a domain's journal chain from its latest seal, and whether every digest held."
-
-    attribute :run,       AuditKey
-    attribute :domain,    AuditedDomain
-    attribute :checked,   Count,   optional: true
-    attribute :report,    Finding, optional: true
-    identified_by :run
-
-    value_object "AuditKey" do
-      attribute :value, String, matches: :present
-
-      invariant("an audit is named") { !value.to_s.empty? }
-    end
-
-    value_object "AuditedDomain" do
-      attribute :value, String, matches: :not_empty
-    end
-
-    value_object "Count" do
-      attribute :value, Integer
-    end
-
-    value_object "Finding" do
-      attribute :value, String
-    end
-
-    lifecycle :status, default: "requested" do
-      mark :failure, "unproven"
-      transition "Confirm" => "verified", from: "requested"
-      transition "Fail"    => "unproven", from: "requested"
-      mark :terminal, "unproven", "verified"
-    end
-
-    command "Verify" do
-      role "Auditor"
-      goal "Walk a domain's journal chain from its latest seal and say whether it was altered"
-
-      attribute :domain, AuditedDomain, sets: true
-      attribute :run,    AuditKey, sets: true
-
-
-      emits VerificationRequested
-    end
-
-    command "Confirm" do
-      role "System"
-      goal "Record that every row's digest held, and how many were checked"
-
-      reference_to Audit
-      attribute :checked, Count, sets: true
-      attribute :report,  Finding, sets: true
-
-      given("the walk checked a row") { checked.value > 0 }
-
-
-      emits ChainConfirmed
-    end
-
-    # A chain that cannot be shown intact is unproven, whether a digest failed or the walk could not
-    # run; the report names the row or the reason.
-    command "Fail" do
-      role "System"
-      goal "Record that the chain could not be shown intact, and why"
-
-      reference_to Audit
-      attribute :report, Finding, sets: true
-
-
-      emits ChainUnproven
-    end
-
-    query "Verdict" do
-      description "What one audit found."
-      attribute :run, AuditKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Unproven" do
-      description "Every audit that could not show the chain intact."
-      where(status: "unproven")
-      order_by :run
-    end
-  end
-
-  # A compaction is applied only once the head it would erase is sealed.
-  policy "CaptureWhenCompactionPermitted" do
-    on      "Era.EraPermitted"
-    where do
-      operation.value == "compact" || operation.value == "compact_heki"
-    end
-    ask     :capture, with: { run: :run }
-  end
-
-  policy "RecordTheSeal" do
-    on      "Era.HeadCaptured"
-    trigger Seal::Record, with: { run: :run, domain: :domain, through: :through, head: :head, previous: :previous }
-  end
-
-  policy "CompactWhenSealed" do
-    on      "Era.HeadCaptured"
-    ask     :apply, with: { run: :run }
-  end
-
-  policy "AbandonWhenNotSealed" do
-    on      "Era.CaptureRefused"
-    trigger Era::Abandon, with: { refusal: :refusal }
-  end
-
-  policy "WalkWhenVerificationRequested" do
-    on      "Audit.VerificationRequested"
-    ask     :walk, with: { run: :run }
-  end
-
-  policy "ConfirmWhenChainWalked" do
-    on      "Audit.ChainWalked"
-    trigger Audit::Confirm, with: { checked: :checked, report: :report }
-  end
-
-  policy "FailWhenWalkRefused" do
-    on      "Audit.WalkRefused"
-    trigger Audit::Fail, with: { report: :refusal }
-  end
-end

data/lib/hecks/hecks/rehearsal.bluebook

@@ -1,437 +0,0 @@
-Hecks.bluebook "Hecks" do
-  # Rehearsal: operating a domain, in the Operations module (ADR 0096). Whether a domain at a pin
-  # would mint its next era against a copy of its real data, and what the mint would refuse.
-  #
-  # A rehearsal is a run like the Codebase `*Run`s: it is requested, the outside is asked, and the
-  # facts it brought back are judged by the givens and reactions below. It differs from them in
-  # two ways. It acts on a client's domain, not on this checkout, so it needs no hecks checkout
-  # and sits with Custodian, not Codebase. And it keeps nothing: the aggregate is bound to Memory
-  # in hecks.hecksagon, and what it found is its report, returned to the caller.
-  #
-  # Where the data it reads comes from is the subject's own `.world` (`rehearsed_by`), never an
-  # argument. The RehearsalStore port prepares that copy, loads the domain against it, runs the
-  # mint's audit over it without writing an era, and drops it, so the copy never outlives the run
-  # whichever way the chain of reactions ends.
-
-  aggregate "RehearsalRun" do
-    description "One rehearsal of a domain's next era against a copy of its data: what a mint would do, and what it would refuse."
-
-    acknowledges :key_by_value, "the domain's path, and Introspection declares queries only, so it holds no records and a reference would be refused on every write",
-                 of: :domain
-
-    attribute :run,            RunKey
-    attribute :domain,         DomainPath
-    attribute :pin,            Pin,         optional: true
-    attribute :host_version,   HostVersion, optional: true
-    attribute :store,          StoreKind,   optional: true
-    attribute :mode,           StoreMode,   optional: true
-    attribute :environment_loaded, EnvironmentLoaded, optional: true
-    attribute :schema_used,    SchemaRead,  optional: true
-    attribute :eras_held,      Count,       optional: true
-    attribute :journal_entries, Count,      optional: true
-    attribute :head_rows,      Count,       optional: true
-    attribute :census,         list_of(HeldCount), optional: true
-    attribute :copy_empty,     Switch,      optional: true
-    attribute :copy_note,      Report,      optional: true
-    attribute :booted,         Switch,      optional: true
-    attribute :before,         ShapeLabel,  optional: true
-    attribute :after,          ShapeLabel,  optional: true
-    attribute :minting,        Minting,     optional: true
-    attribute :edge_present,   Switch,      optional: true
-    attribute :refused_rows,   list_of(RefusedRow), optional: true
-    attribute :refusal_total,  Count,       optional: true
-    attribute :audited,        Switch,      optional: true
-    attribute :rows_examined,  Count,       optional: true
-    attribute :rust_rows_examined, Count,   optional: true
-    attribute :aggregates_examined, Count,  optional: true
-    attribute :reason,         Report,      optional: true
-    attribute :parity,         Parity,      optional: true
-    attribute :unchecked,      list_of(Limit), optional: true
-    attribute :verdict,        Verdict,     optional: true
-    attribute :released,       Switch,      optional: true
-    attribute :kept,           Report,      optional: true
-    attribute :boot_error,     Report,      optional: true
-    attribute :refusal,        Report,      optional: true
-    identified_by :run
-
-    value_object "RunKey" do
-      attribute :value, String, matches: :present
-
-      invariant("a rehearsal is named") { !value.to_s.empty? }
-    end
-
-    # The domain's directory: where its bluebooks and its `.world` stand.
-    value_object "DomainPath" do
-      attribute :value, String, matches: :not_empty
-    end
-
-    # The Hecks the rehearsal must run on: a release (`3.9.0`) or a commit, whole or a prefix.
-    value_object "Pin" do
-      attribute :value, String, pattern: '^[0-9a-f]{7,40}$|^[0-9]+[.][0-9]+[.][0-9]+'
-    end
-
-    value_object "HostVersion" do
-      attribute :value, String, matches: :present
-    end
-
-    # Which strategy the subject's world named for the copy of its data.
-    value_object "StoreKind" do
-      attribute :value, String, one_of: ["memory", "postgres"]
-
-      invariant("a store is one the language names") { ["memory", "postgres"].include?(value) }
-    end
-
-    # What the copy holds: nothing, a restored dump, or a copy somebody else made, read as it is.
-    value_object "StoreMode" do
-      attribute :value, String, one_of: ["empty", "dump", "readonly_copy"]
-
-      invariant("a mode is empty, dump or readonly_copy") { ["empty", "dump", "readonly_copy"].include?(value) }
-    end
-
-    # The environment overlay the subject was loaded under and where that was decided: `world`
-    # (its `rehearsed_by` named one), `HECKS_PROJECT_ENVIRONMENT`, `default` (production, because
-    # its overlay exists, as the host build does) or `none`. A domain's binds are usually declared
-    # in that overlay, so a rehearsal that loaded another one rehearsed another domain.
-    value_object "EnvironmentLoaded" do
-      attribute :name,   String
-      attribute :source, String, pattern: '^(world|HECKS_PROJECT_ENVIRONMENT|default|none)$'
-      attribute :file,   String
-    end
-
-    # The Postgres schema the copy was read in, where that was decided (`world`, `HECKS_SCHEMA`,
-    # `derived` from the domain's name, `default` public, or `memory` for a document) and whether
-    # the copy has it.
-    value_object "SchemaRead" do
-      attribute :name,    String
-      attribute :source,  String, pattern: '^(world|HECKS_SCHEMA|derived|default|memory)$'
-      attribute :present, Boolean
-    end
-
-    # One aggregate's rows in the copy: what its head table holds and the records its journal's
-    # latest entries hold. The audit reads the journal, so a difference is shown, not refused.
-    value_object "HeldCount" do
-      attribute :aggregate, String
-      attribute :head,      Integer
-      attribute :journal,   Integer
-    end
-
-    value_object "Switch" do
-      attribute :value, Boolean
-    end
-
-    value_object "Count" do
-      attribute :value, Integer
-
-      invariant("a count is not negative") { value >= 0 }
-    end
-
-    # The first six hex digits of a storage shape's digest, or `none` when no era is held.
-    value_object "ShapeLabel" do
-      attribute :value, String, pattern: '^[0-9a-f]{6}$|^none$'
-    end
-
-    # Which era a mint would hold: none (the shape stands), the first, or the next.
-    value_object "Minting" do
-      attribute :value, String, one_of: ["none", "first", "next"]
-
-      invariant("a mint is none, first or next") { ["none", "first", "next"].include?(value) }
-    end
-
-    # One stored record the mint's audit would refuse, named `Aggregate#id`, with the rule that
-    # refused it (a value the new types or invariants refuse, a state the lifecycle never reaches,
-    # a reference the edge cannot carry) and the audit's own wording.
-    value_object "RefusedRow" do
-      attribute :aggregate, String
-      attribute :id,        String
-      attribute :rule,      String, pattern: '^(value|lifecycle|reference)$'
-      attribute :wording,   String
-    end
-
-    # How the other engine's audit stood: not run, in agreement with this one, or not.
-    value_object "Parity" do
-      attribute :engine, String
-      attribute :status, String, pattern: '^(not_run|agree|differ)$'
-      attribute :note,   String
-    end
-
-    # One thing a rehearsal did not check, and why. A rehearsal states its limits.
-    value_object "Limit" do
-      attribute :what, String
-      attribute :why,  String
-    end
-
-    # The five things a rehearsal can conclude. A would_mint of `minting: none` says the shape
-    # stands and nothing would be minted at all. `empty_copy` says the copy held no row of the
-    # domain, so nothing was rehearsed and no answer about the data is given.
-    value_object "Verdict" do
-      attribute :value, String, one_of: ["would_mint", "would_refuse", "needs_edge", "cannot_boot", "empty_copy"]
-
-      invariant("a verdict is one the rehearsal names") do
-        ["would_mint", "would_refuse", "needs_edge", "cannot_boot", "empty_copy"].include?(value)
-      end
-    end
-
-    value_object "Report" do
-      attribute :value, String
-    end
-
-    # Only the first rows are held, so a domain with a million stale rows is a report, not a
-    # flood; the total says how many there were.
-    invariant("no more than fifty refused rows are held") { refused_rows.unset? || refused_rows.size <= 50 }
-    invariant("the total counts at least the rows held") do
-      refused_rows.unset? || refusal_total.unset? || refusal_total.value >= refused_rows.size
-    end
-    invariant("a rehearsal that would mint holds no refused row") do
-      verdict.unset? || verdict.value != "would_mint" || refusal_total.unset? || refusal_total.value == 0
-    end
-    invariant("only a domain that booted would mint") do
-      verdict.unset? || verdict.value != "would_mint" || booted.unset? || booted.value
-    end
-    invariant("a copy that holds nothing is never judged to mint") do
-      verdict.unset? || verdict.value != "would_mint" || copy_empty.unset? || !copy_empty.value
-    end
-    invariant("an empty_copy verdict is given for a copy that holds nothing") do
-      verdict.unset? || verdict.value != "empty_copy" || (!copy_empty.unset? && copy_empty.value)
-    end
-    invariant("only a mint of the next era audits stored rows") do
-      audited.unset? || !audited.value || minting.unset? || minting.value == "next"
-    end
-    invariant("a mint of the next era that would go through states how many rows were examined") do
-      verdict.unset? || verdict.value != "would_mint" || minting.unset? || minting.value != "next" || !rows_examined.unset?
-    end
-    invariant("a clean verdict that examined no row says so in what it did not check") do
-      verdict.unset? || verdict.value != "would_mint" || audited.unset? || audited.value ||
-        (!unchecked.unset? && unchecked.any? { |limit| limit.what == "the stored rows" })
-    end
-
-    # `requested` is the rehearsal and its store being prepared; `booted` the domain loaded and
-    # its shape read; `audited` the mint's audit run over the data. `judged` is a rehearsal whose
-    # answer is that the mint would go through, `withheld` one whose answer is that it would not
-    # (the verdict says which way), `refused` one that was never run because the request or the
-    # store was not admitted, and `failed` one that broke after it began.
-    lifecycle :status, default: "requested" do
-      mark :failure, "withheld", "refused", "failed"
-      transition "Boot"     => "booted",   from: "requested"
-      transition "Audit"    => "audited",  from: "booted"
-      transition "Judge"    => "judged",   from: "audited"
-      transition "Withhold" => "withheld", from: %w[requested booted audited]
-      transition "Refuse"   => "refused",  from: "requested"
-      transition "Fail"     => "failed",   from: %w[requested booted audited]
-      mark :terminal, "failed", "judged", "refused", "withheld"
-    end
-
-    command "Request" do
-      role "Operator"
-      goal "Rehearse a domain's next era against the copy of its data its world names, say whether a mint would go through, and print the whole outcome"
-
-      attribute :run,    RunKey, sets: true
-      attribute :domain, DomainPath, sets: true
-      attribute :pin,    Pin, optional: true, sets: true
-
-
-      emits RehearsalRequested
-    end
-
-    # What the subject reported once it was loaded against the prepared copy.
-    command "Boot" do
-      role "System"
-      goal "Record that the domain loaded, the shape it stands at and the era a mint would hold"
-
-      reference_to RehearsalRun
-      attribute :booted,       Switch, sets: true
-      attribute :host_version, HostVersion, sets: true
-      attribute :store,        StoreKind, sets: true
-      attribute :mode,         StoreMode, sets: true
-      attribute :before,       ShapeLabel, sets: true
-      attribute :after,        ShapeLabel, sets: true
-      attribute :minting,      Minting, sets: true
-      attribute :environment_loaded, EnvironmentLoaded, sets: true
-      attribute :schema_used,  SchemaRead, sets: true
-      attribute :eras_held,    Count, sets: true
-      attribute :journal_entries, Count, sets: true
-      attribute :head_rows,    Count, sets: true
-      attribute :census,       list_of(HeldCount), sets: true
-      attribute :copy_empty,   Switch, sets: true
-      attribute :copy_note,    Report, sets: true
-      attribute :released,     Switch, optional: true, sets: true
-      attribute :kept,         Report, optional: true, sets: true
-
-      given("the domain loaded") { booted.value }
-
-
-      emits RehearsalBooted
-    end
-
-    # The mint's own three layers and its edge and coverage rules, run over the copy.
-    command "Audit" do
-      role "System"
-      goal "Record whether an edge leads to the shape, and every row the mint's audit would refuse"
-
-      reference_to RehearsalRun
-      attribute :minting,       Minting, sets: true
-      attribute :edge_present,  Switch, sets: true
-      attribute :refused_rows,  list_of(RefusedRow), optional: true, sets: true
-      attribute :refusal_total, Count, sets: true
-      attribute :audited,       Switch, sets: true
-      attribute :rows_examined, Count, sets: true
-      attribute :rust_rows_examined, Count, sets: true
-      attribute :aggregates_examined, Count, sets: true
-      attribute :reason,        Report, sets: true
-      attribute :parity,        Parity, sets: true
-      attribute :unchecked,     list_of(Limit), sets: true
-      attribute :released,      Switch, sets: true
-      attribute :kept,          Report, optional: true, sets: true
-
-
-      emits RehearsalAudited
-    end
-
-    command "Judge" do
-      role "System"
-      goal "Record that the mint would go through: the domain booted, an edge leads on where one is needed, and nothing is refused"
-
-      reference_to RehearsalRun
-      attribute :verdict,       Verdict, sets: true
-      attribute :refusal_total, Count
-      attribute :edge_present,  Switch
-
-      given("a rehearsal that finds a refused row would not mint") { refusal_total.value == 0 }
-      given("a rehearsal judged to mint names that verdict") { verdict.value == "would_mint" }
-
-
-      emits RehearsalJudged
-    end
-
-    command "Withhold" do
-      role "System"
-      goal "Record that the mint would not go through, which of the three ways, and what it would say"
-
-      reference_to RehearsalRun
-      attribute :verdict, Verdict, sets: true
-      attribute :refusal, Report, sets: true
-
-      given("a withheld rehearsal names how the mint would stop") { verdict.value != "would_mint" }
-
-
-      emits RehearsalWithheld
-    end
-
-    command "Refuse" do
-      role "System"
-      goal "Record that the rehearsal was not run: the subject, the pin or the store was not admitted, and why"
-
-      reference_to RehearsalRun
-      attribute :refusal, Report, sets: true
-
-
-      emits RehearsalRefused
-    end
-
-    command "Fail" do
-      role "System"
-      goal "Record that the rehearsal broke after it began, and why"
-
-      reference_to RehearsalRun
-      attribute :refusal, Report, sets: true
-
-
-      emits RehearsalFailed
-    end
-
-    query "RehearsalOutcome" do
-      description "How one rehearsal ended: its status and verdict, and every fact it brought back. A run is kept by the process that made it, so a run this process does not hold is refused as unknown; `request` waits for its reactions and prints the whole outcome."
-      attribute :run, RunKey
-      where(run: :run)
-      order_by :run
-    end
-
-    query "Withheld" do
-      description "Every rehearsal of this process whose answer was that the mint would not go through."
-      where(status: "withheld")
-      order_by :run
-    end
-  end
-
-  policy "SurveyWhenRehearsalRequested" do
-    on      "RehearsalRun.RehearsalRequested"
-    ask     :survey, with: { run: :run }
-  end
-
-  policy "RefuseWhenStoreNotAdmitted" do
-    on      "RehearsalRun.StoreRefused"
-    trigger RehearsalRun::Refuse, with: { refusal: :refusal }
-  end
-  policy "RecordBootWhenStoreSurveyed" do
-    on      "RehearsalRun.StoreSurveyed"
-    where   { booted.value }
-    trigger RehearsalRun::Boot, with: { booted: :booted, host_version: :host_version, store: :store, mode: :mode,
-                                         before: :before, after: :after, minting: :minting,
-                                         environment_loaded: :environment_loaded, schema_used: :schema_used,
-                                         eras_held: :eras_held, journal_entries: :journal_entries,
-                                         head_rows: :head_rows, census: :census, copy_empty: :copy_empty,
-                                         copy_note: :copy_note, released: :released, kept: :kept }
-  end
-
-  # A copy that holds none of the domain's rows is not rehearsed: there is nothing to audit, and a
-  # clean answer over it would be a confident wrong one. The survey has already dropped it.
-  policy "WithholdWhenTheCopyHoldsNothing" do
-    on      "RehearsalRun.RehearsalBooted"
-    where   { copy_empty.value }
-    trigger RehearsalRun::Withhold, with: { verdict: "empty_copy", refusal: :copy_note }
-  end
-
-  # A domain that does not load is an answer, not a breakdown: it is what the mint would be
-  # stopped by, so it is judged, not failed.
-  policy "WithholdWhenSubjectDoesNotBoot" do
-    on      "RehearsalRun.StoreSurveyed"
-    where   { !booted.value }
-    trigger RehearsalRun::Withhold, with: { verdict: "cannot_boot", refusal: :boot_error }
-  end
-
-  policy "FailWhenExaminationRefused" do
-    on      "RehearsalRun.ExamineRefused"
-    trigger RehearsalRun::Fail, with: { refusal: :refusal }
-  end
-
-  policy "ExamineWhenBooted" do
-    on      "RehearsalRun.RehearsalBooted"
-    where   { !copy_empty.value }
-    ask     :examine, with: { run: :run }
-  end
-
-  policy "RecordAuditWhenStoreExamined" do
-    on      "RehearsalRun.StoreExamined"
-    trigger RehearsalRun::Audit, with: { minting: :minting, edge_present: :edge_present,
-                                          refused_rows: :refused_rows, refusal_total: :refusal_total,
-                                          audited: :audited, rows_examined: :rows_examined,
-                                          rust_rows_examined: :rust_rows_examined,
-                                          aggregates_examined: :aggregates_examined, reason: :reason,
-                                          parity: :parity, unchecked: :unchecked,
-                                          released: :released, kept: :kept }
-  end
-
-  policy "JudgeWhenNothingWouldStopTheMint" do
-    on      "RehearsalRun.RehearsalAudited"
-    where do
-      (minting.value != "next" || edge_present.value) && refusal_total.value == 0
-    end
-    trigger RehearsalRun::Judge, with: { verdict: "would_mint", refusal_total: :refusal_total,
-                                          edge_present: :edge_present }
-  end
-
-  policy "WithholdWhenNoEdgeLeadsOn" do
-    on      "RehearsalRun.RehearsalAudited"
-    where   { minting.value == "next" && !edge_present.value }
-    trigger RehearsalRun::Withhold, with: { verdict: "needs_edge",
-                                             refusal: "no translation edge leads the held era to this shape" }
-  end
-
-  policy "WithholdWhenTheMintWouldRefuse" do
-    on      "RehearsalRun.RehearsalAudited"
-    where do
-      (minting.value != "next" || edge_present.value) && refusal_total.value > 0
-    end
-    trigger RehearsalRun::Withhold, with: { verdict: "would_refuse",
-                                             refusal: "the mint would refuse: see the refused rows" }
-  end
-end