overview / faq
Run rabadon doctor first. It checks the native binaries, version lockstep, the sandbox backend, global hook health, the claude CLI, and the spool. Most of the answers below start there.
| question | short answer |
|---|---|
| The gate is not firing — why? | Work through these in order: Check the mode. rabadon status. |
| How do I disable one rule? | Add its id to disabled[] in .rabadon/guard.json: Prefer this over turning the whole gate off. |
| Will it slow my session? | No meaningfully. The gate is deterministic native C++ and decides in 2.8 ms at the median (2.78 ms allow, 3.70 ms deny, n=40); the hook timeout it… |
| How much disk does the ledger use? | About 2.7 MB a day, and the gate keeps 30 days of it. Measured on the machine that writes this: 30 days of JSONL in ~/.rabadon/spool came to 82 MB. |
| Does anything leave my machine? | No. Events go over a local unix socket and to local files under ~/.rabadon. |
| The install didn't build the binary — what now? | npm i -g rabadon pulls a prebuilt @rabadon/<platform> binary on darwin-arm64, darwin-x64, linux-x64 and linux-arm64. |
| What if rabadon itself crashes? | It fails open. A bug in rabadon is treated by Claude Code as allow — a broken gate never blocks your session. |
| I need to restore my settings — where is the backup? | Every time rabadon first writes to an existing .claude/settings.json, it copies it to .claude/settings.json.bak-rabadon. |
| Is the ledger really unedited? | Run rabadon audit. It re-walks the hash chain and exits 1 if any link is broken, naming the file and line. rabadon replay renders the verified… |
| The sandbox says no backend — what do I install? | macOS: sandbox-exec ships with the OS; if rabadon doctor reports it missing, your environment is unusual. |