repo / protocol

Deterministic repository policy

Prompts suggest.
Gates decide.

Protect migrations, manifests, and project contracts with a compact, versioned policy that says exactly why a change may—or may not—cross.

Install the gate Test a change
  • No LLM judge
  • No network calls
  • Exit codes for CI
A vermilion checkpoint in a paper night landscape sorts code sheets onto an orderly golden path.
Checkpoint 01 Every verdict points back to a rule and line.

Instructions are not enforcement

Four checks. One inspectable contract.

Keep the context in AGENTS.md. Put the invariants in repo-protocol.yaml, where agents, humans, and CI get the same answer every time.

  1. 01

    Protected paths

    Assign explicit change classes to README files, lockfiles, deployment specs, or any Git glob.

    paths
  2. 02

    Generator evidence

    Bind a generated artifact to its exact SHA-256 and an approved generator identity.

    generators
  3. 03

    Required metadata

    Require a ticket, source path, or team-defined field before generated work can pass.

    metadata
  4. 04

    Change relationships

    A migration can require its schema; an artifact can require its source in the same diff.

    changed_any_of

Runs locally in this page

Put a proposed diff at the gate.

Edit the paths or load a known case. Nothing leaves your browser.

Policy v1

README.md
human only
db/migrations/**
drizzle-kit + evidence
relationship
db/schema/**
Load an example

Use A, M, or D. Example: A db/migrations/0042_users.sql

Gate report

Ready for inspection

Choose a preset or edit the proposed changes, then inspect.

    Free · MIT · one binary

    From zero to enforced in fifteen minutes.

    Start with the template, name the paths your team cares about, and add the same command to local hooks and CI.

    Build from sourceRust stable
    cargo install --git https://github.com/B-Divyesh/sf-repo-protocol-gate repo-protocol

    1repo-protocol init

    Write a starter policy.

    2repo-protocol validate

    Catch schema and glob errors.

    3repo-protocol check --staged

    Get a line-level verdict.

    Open the policy field reference

    paths selects protected changes with Git-style globs. allow.change_classes names trusted workflow classes.

    allow.generators checks the generator in hash-bound evidence. require.metadata requires non-empty evidence values.

    changed_any_of and changed_all_of connect generated artifacts to source changes in the same diff.