rabadon 0.2.0 — 2026-08-05

Tagged, and not published. This line used to read "First published release. npm i -g rabadon", which the registry disagrees with: npm view rabadon returns 404, and the release workflow failed on the darwin-arm64 build for v0.2.0, v0.2.1 and v0.2.2, taking the publish job with it each time. The workflow and its provenance attestation are wired and have never once run to completion. A changelog announcing a release nobody can install is the same class of error as a benchmark citing a file that does not exist.

The gate

Deny decisions are made in native C++ before a command is produced, not after it runs. Force-push to a protected branch, recursive deletes outside a project, and untested pushes are refused at emit time.
Eleven laws are compiled into the binary and hold with no configuration at all. Any of them can be switched off by id in a project's disabled[] — none is sealed, and the README says the same. Everything else lives in a project's .rabadon/guard.json, and a rule born from a real incident carries authoredBy: incident.
rabadon drill produces a real refusal on a throwaway command so a new user sees the mechanism in one step. Drills are tagged at emit and excluded from the ledger, so they never inflate rabadon usage.

The repair loop

When a suite goes red, a proposer writes a patch in an isolated copy and the arbiter runs the project's own check command. The verdict is that command's exit code. No model is asked whether the repair is real.
Test files and the harness are hash-locked before the proposer starts. A patch that edits, deletes, skips, or neuters a locked test is refused, and the accepted-repair counter does not move.
A red result is re-sampled. If two samples disagree the verdict is FLAKY rather than verified.

The ledger

Every gated event is appended to a hash-chained day file. rabadon audit detects an edited character, a dropped line, a truncated tail, a stripped prev, a re-forged chain, and a deleted day file.
Events carry the calling tool's id and the session id, so a trace can be rebuilt per session without instrumenting anything.

Install

Prebuilt binaries ship as @rabadon/<platform> optional dependencies with npm provenance. Where no prebuilt matches, postinstall compiles the native core from the source in the package.
Verified on a clean HOME from the packed tarball: install, rabadon init, rabadon on, rabadon drill, and the gate refuses with exit 2.

Packaging

The published tarball carries 53 files at 360.3 kB. Unit tests, demo fixtures, example guard packs, and maintainer release scripts are no longer shipped.

commands

rabadon init · rabadon on | off | status | toggle · rabadon usage · rabadon drill · rabadon audit