Getting started

Two ways in. Pick the one that matches what you are building, then run the refusal at the bottom so you have watched the boundary hold once.

Install specgen

specgen reads KDL policy plus committed locks and builds a standalone guarded CLI, with no hand-written Go.

brew tap coilyco-flight-deck/tap https://forgejo.coilysiren.me/coilyco-flight-deck/homebrew-tap
brew install coilyco-flight-deck/tap/specgen

scoop bucket add coilyco-flight-deck https://forgejo.coilysiren.me/coilyco-flight-deck/scoop-bucket
scoop install coilyco-flight-deck/specgen

Tagged releases also publish raw binaries and SHA256SUMS for Linux, macOS, and Windows on amd64 and arm64. specgen shells out to the Go toolchain to resolve locks and build, so Go has to be present.

Or import the primitives

Every package stands alone if you are adding a boundary to an existing urfave/cli v3 app.

GOPRIVATE=forgejo.coilysiren.me go get forgejo.coilysiren.me/coilyco-flight-deck/umbra

See a refusal

The shortest runnable example rejects a shell metacharacter before execve:

go run ./examples/policy unsafe 'foo; rm -rf /'

examples/ holds one app per primitive, and its README gives a reading order from the minimum useful program up to the network gate.

Next

The no-code driver covers authoring the guardfile. Architecture covers the two surfaces underneath it.