Prove the failure mode before integrating.

Start from source. The first demo shows why effect evidence matters even after an action was authorized.

1. Bootstrap a clean source checkout

npm run check:bootstrap
npm run check:source-manifest

2. Run the quickstart

node packages/cli/bin/ruleoak.js demo quickstart

3. Run the Effect Boundary demo

node packages/cli/bin/ruleoak.js demo effect-boundary

The demo performs an external filesystem effect, loses the execution response, verifies the expected digest and refuses a duplicate retry when success is confirmed.

4. Inspect an MCP route without changing it

node packages/cli/bin/ruleoak.js protect --setup --dry-run

5. Apply a supported boundary

node packages/cli/bin/ruleoak.js protect --setup --apply
node packages/cli/bin/ruleoak.js protect check

Do not treat READY_POLICY_ONLY as a full Effect Boundary. It means policy/interception works but trusted postcondition semantics are missing for at least one route.

6. Reconcile ambiguity without replay

node packages/cli/bin/ruleoak.js effect pending
node packages/cli/bin/ruleoak.js effect reconcile --limit 20
node packages/cli/bin/ruleoak.js effect retry-plan --id <effect-id>

Optional npm convenience

Only after @ruleoak/cli@0.50.0 is actually public on npm:

npx @ruleoak/cli@0.50.0 demo quickstart

Before protecting real actions

1. Choose one consequential path you control.
2. Prove the action cannot bypass the RuleOak path accidentally.
3. Confirm deny/approval-required prevents execution.
4. Define a reviewed postcondition only if the real effect is externally observable.
5. Exercise timeout/response-loss behavior.