Fotbiler.RuleGate.Cli 1.0.0

RuleGate CLI

Fotbiler.RuleGate.Cli is the RuleGate command-line tool for deterministic manifest validation and linting, policy testing, redacted decision explanations, C# constant generation, stale-output checks, and CI automation.

Install

dotnet tool install \
  --global \
  Fotbiler.RuleGate.Cli \
  --version 1.0.0

The installed command is rulegate.

Supported runtimes

• .NET 8
• .NET 9
• .NET 10

Validate manifests

rulegate validate
rulegate validate ./policies/rulegate.yaml
rulegate validate --format json

Test policy behavior

rulegate test
rulegate test ./policies/authorization.tests.yaml
rulegate test ./policies/authorization.tests.yaml --filter organization
rulegate test ./policies/authorization.tests.yaml --format json

Fixtures evaluate explicit authorization requests against a compiled manifest without starting the host application. They support allow, deny, indeterminate, and exact failure-code expectations with fixed evaluation times.

Explain and lint

rulegate explain \
  ./policies/authorization.tests.yaml \
  --test organization-mismatch

rulegate lint ./policies/rulegate.yaml
rulegate lint ./policies/rulegate.yaml --format json

Explanation uses the runtime evaluator pipeline but omits subject/resource identities and every request or literal value. Lint reports deterministic structural findings and returns 1 when any finding exists.

Validated manifests can be activated at runtime through RuleGate policy sources. See the policy-source guide for atomic reload behavior.

Validation covers the complete manifest requirement model, including typed attributes, attribute comparisons, explicit-time-zone schedules, bounded date-time rules, authentication age, and canonical context policies.

Generate C# constants

rulegate generate csharp \
  ./rulegate.yaml \
  --namespace Sample.Authorization

Write deterministic UTF-8 source to a file:

rulegate generate csharp \
  ./rulegate.yaml \
  --namespace Sample.Authorization \
  --output Generated/RuleGate.g.cs

The generated file contains:

• RuleGatePolicies
• RuleGateResourceTypes
• RuleGateActions

Detect stale output

rulegate generate csharp \
  ./rulegate.yaml \
  --namespace Sample.Authorization \
  --output Generated/RuleGate.g.cs \
  --check

Check mode does not modify the file. Current output returns 0; missing or stale output returns 1.

Fail-closed generation

Generation runs only after complete manifest compilation. Invalid manifests, invalid namespaces, empty values, and identifier collisions produce no source. Existing output files are preserved when generation fails.

Help, version, and information

rulegate --help
rulegate validate --help
rulegate test --help
rulegate explain --help
rulegate lint --help
rulegate generate csharp --help
rulegate --version
rulegate info

Exit codes

RuleGate packages

Documentation

• RuleGate CLI guide
• Policy testing
• Explain and Lint
• Manifest guide
• Telemetry, performance, and concurrency
• Security model
• Roadmap
• Documentation index