RuleOak
Open Source · Developers

Put RuleOak in front of one consequential action.

Start narrow. Prove the action crosses RuleOak, prove deny stops it, then add effect semantics only where you can observe the real postcondition.

Source checkout

git clone https://github.com/ruleoak/ruleoak.git
cd ruleoak
git checkout v0.50.0
npm run check:bootstrap
npm run check:source-manifest

If the fresh repository/tag is not yet public, use the sealed v0.50.0 source archive and verify its SHA-256 first.

Package roles

PackageRole
@ruleoak/protocolSchemas, validators, conformance vectors and stable public contracts.
@ruleoak/coreAuthority, policy, leases, effects, evidence, Inspector, Flight Recorder and CrashLab runtime.
@ruleoak/cliMCP/operator workflows, reconciliation, approvals, evidence and release diagnostics.

Minimal guarded function

const ruleoak = await createRuleOak({ workspace: '.ruleoak', policy })
const guarded = ruleoak.guardFunction({
  name: 'filesystem.write',
  category: 'file',
  operation: 'write',
  resource: ([path]) => path,
  execute: async (path, bytes) => writeFile(path, bytes)
})

Five checks before production-like use

  1. Confirm every consequential path actually crosses RuleOak.
  2. Confirm deny/approval-required prevents execution.
  3. Confirm one-use authority rejects replay.
  4. Document which operations have trusted effect semantics and which are policy-only.
  5. Exercise timeout/response-loss/restart behavior and preserve unresolved effects explicitly.
ExamplesArchitectureTroubleshooting