A thin, dependency-light command line over arl-core + arl-sandbox — the
gate logic stays single-sourced in the libraries; this is a faithful
front end so a claim can be checked in CI:
arl validate <claim.json> cross-axis gates → exit 0 (pass) / 1 (fail)
arl lint <claim.json> controlled-vocabulary findings (excluded → exit 1)
arl verify <session.json> <attestation.json> attestation check
arl explain the axes and gates, as a cheat sheet
Exit codes make it a pipeline gate: a claim that fails the ARL gates fails
the build. Verified end-to-end through the built binary — a minimal claim
deserializes with omitted fields at the uncharacterized floor and the 8
gates fire (incl. the AGI exclusion); lint flags excluded terms; verify
round-trips a real Supervisor attestation and rejects a tampered session.
Two correctness/ergonomics fixes this enabled:
- Claim is #[serde(default)] — a hand-written claim JSON may omit fields;
missing ones default to the honest floor (ARL 1 / Class E / S0 /
energy undisclosed / flags false).
- ValidationDepth is #[serde(try_from = "u8")] — an out-of-range depth
(e.g. 99) is now rejected at the parse boundary, not silently accepted.
- arl-sandbox re-exports SigningKey/VerifyingKey so consumers build a
Supervisor without depending on ed25519-dalek directly.
arl-cli 9 tests; arl-rs workspace 51 tests, 0 failures.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
cca3fa9369