Build software that stays understandable when things go wrong.
RuleOak develops software and open-source systems around explicit authority, evidence, resilience and local-first operation. We focus on the difficult boundary between what software intended to do, what it was allowed to do, and what actually happened.
Evidence before confidence.
Explicit authority
Consequential actions should have an inspectable authority path rather than relying on hidden assumptions, model confidence or accidental access.
Observable outcomes
A successful request is not always proof that the intended external effect happened. Failure and retry behavior need evidence of the actual postcondition.
Recoverable systems
Timeouts, crashes, stale state and partial failure are normal engineering conditions. Recovery behavior should be designed and tested, not improvised.
Local-first where practical
User-owned state and essential guidance should not become unavailable merely because a hosted service is down or unnecessary.
Honest release evidence
Source checks, native builds, device runs, store acceptance and live deployment prove different things. We keep those boundaries visible.
RuleOak v0.50.0
RuleOak v0.50.0 is the starting public release of our Apache-2.0 Effect Boundary project for supported AI-agent and MCP tool actions.
It connects exact authorization, one-use execution authority, effect evidence and retry disposition so a timeout does not automatically become a duplicate action. The public repository includes source, tests, schemas, conformance material, examples and qualification tooling.
Start with one real boundary.
Before integrating broadly, decide whether RuleOak is the right authority for the problem, choose the actual interception point, and design the timeout/retry path.
Is RuleOak a fit?
Strong fits, partial fits and problems that belong to other controls.
Where should it run?
Compare SDK, MCP and local-service patterns.
What happens after timeout?
Preserve ambiguity, reconcile evidence and require fresh authority for retry.
What do the tests prove?
Keep source, package, deployment and external evidence separate.
What we deliberately do not claim.
- We do not turn a test that did not run into PASS.
- We do not call source-level preparation a store, deployment or independent-security result.
- We do not treat AI-generated output as self-certifying evidence.
- We do not convert missing or conflicting evidence into silent certainty.
- We do not describe an application-layer control as an operating-system sandbox.
RuleOak Pte. Ltd.
RuleOak Pte. Ltd. is a Singapore-incorporated software publisher and the steward of the RuleOak open-source project. Our public engineering material is intentionally inspectable: architecture, limitations, release-evidence boundaries, security reporting and open-source verification all have dedicated documentation.
RuleOak Pte. Ltd. · Singapore · UEN 202639787M