rosetta

package module
v0.0.0-...-320158f Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: MIT Imports: 23 Imported by: 0

README

Rosetta

Rosetta compiles Cedar authorization policy into restrictive configuration for OpenShell, OpenCode, Codex, and Claude Code. Version 1 provides a Go SDK, a standalone CLI, and a stateless HTTP API. The CLI links the SDK directly; it never needs the service to validate or generate policy files.

Rosetta evaluates Cedar against a finite capability catalog. This makes the compilation boundary explicit and reviewable: Cedar decides whether a principal may read a path, use a tool, execute a command, or connect to an endpoint, while each renderer maps only representable decisions into its target format. Missing permits and Cedar forbids are denied. Evaluation errors fail compilation.

Install

Build the CLI or service with Go 1.25.12 or a newer supported release:

go install github.com/asabla/rosetta/cmd/rosetta@v1.0.0
go install github.com/asabla/rosetta/cmd/rosetta-server@v1.0.0

Release pages provide platform archives, checksums, SBOMs, and build-provenance attestations. The service container is published as ghcr.io/asabla/rosetta:v1.0.0 after a version tag is released.

Compile a policy

The repository includes a complete Cedar policy and capability catalog. Compile any supported target without running the API:

rosetta check < examples/developer.cedar
rosetta compile --target openshell --catalog examples/catalog.json < examples/developer.cedar
rosetta compile --target opencode --catalog examples/catalog.json < examples/developer.cedar
rosetta compile --target codex --catalog examples/catalog.json --options examples/options.json < examples/developer.cedar
rosetta compile --target claude-code --mode permissive --catalog examples/catalog.json < examples/developer.cedar

Strict mode is the default and rejects allowed capabilities the target cannot represent without broadening access. --mode permissive may omit such a capability only when omission is a safe deny. The CLI writes every warning to stderr; SDK and HTTP callers receive the same diagnostics in the result.

Use --format json with compile, check, or explain for automation. Compile and explain results include deterministic metadata identifying the compiler, catalog and target-contract versions, normalized mode, and SHA-256 digests of the compilation inputs and artifact:

rosetta compile --format json --target openshell --catalog examples/catalog.json < examples/developer.cedar

Go SDK

The root module is the public SDK:

result, err := rosetta.Compile(ctx, rosetta.CompileRequest{
    Source:  policy,
    Target:  rosetta.TargetOpenCode,
    Catalog: catalog,
})
if err != nil {
    return err
}
fmt.Print(result.Artifacts[0].Content)

Check parses and schema-validates Cedar without a catalog. Explain compiles the same request and returns the capability decisions behind the artifact. Targets and Capabilities expose stable discovery metadata, including each target contract's version and maturity. Target rendering options are accepted through --options; the example uses them to define the transport for a Cedar-restricted Codex MCP server without embedding credentials.

HTTP API

Run rosetta-server or the container and send the same SDK request model to POST /v1/compile. The service also exposes POST /v1/check, POST /v1/explain, discovery endpoints, a health endpoint, and /v1/openapi.json. Request bodies are limited to 2 MiB and unknown JSON fields are rejected.

The architecture, Cedar profile, target support, executable target contracts, security model, and v1 migration guide document the compatibility and trust boundaries.

Documentation

Index

Constants

View Source 
const (
	MaxSourceBytes         = 2 << 20
	MaxCapabilities        = 10_000
	MaxSelectorBytes       = 4096
	MaxDecisionOverlapWork = 250_000
)
View Source 
const (
	ModeStrict     = "strict"
	ModePermissive = "permissive"

	TargetOpenShell = "openshell"
	TargetOpenCode  = "opencode"
	TargetCodex     = "codex"
	TargetClaude    = "claude-code"
)
View Source 
const (
	KindFilesystem = "filesystem"
	KindTool       = "tool"
	KindCommand    = "command"
	KindNetwork    = "network"
)
View Source 
const CatalogVersion = "rosetta/v1"
View Source 
const CedarSchema = `` /* 484-byte string literal not displayed */

CedarSchema is the stable authorization profile compiled by Rosetta v1. Optional target-specific fields let one schema describe all renderer inputs.

View Source 
const Version = "1.0.0"

Version is the Rosetta API and compiler version.

Variables

This section is empty.

Functions

func Targets 

func Targets() []string

Targets returns a copy of the stable target identifiers.

Types

type Artifact 

type Artifact struct {
	Name        string `json:"name"`
	PathHint    string `json:"pathHint,omitempty"`
	MediaType   string `json:"mediaType"`
	Target      string `json:"target"`
	Content     string `json:"content"`
	Encoding    string `json:"encoding"`
	Description string `json:"description,omitempty"`
}

type CapabilitiesRequest 

type CapabilitiesRequest struct{}

type CapabilitiesResult 

type CapabilitiesResult struct {
	Version         string               `json:"version"`
	Capabilities    []string             `json:"capabilities"`
	Targets         []string             `json:"targets"`
	TargetContracts []TargetContractInfo `json:"targetContracts"`
}

func Capabilities 

func Capabilities(ctx context.Context, _ CapabilitiesRequest) (*CapabilitiesResult, error)

type Capability 

type Capability struct {
	ID       string   `json:"id"`
	Kind     string   `json:"kind"`
	Action   string   `json:"action"`
	Selector string   `json:"selector"`
	Targets  []string `json:"targets,omitempty"`

	Access   string   `json:"access,omitempty"`
	Port     int      `json:"port,omitempty"`
	Protocol string   `json:"protocol,omitempty"`
	Path     string   `json:"path,omitempty"`
	Binaries []string `json:"binaries,omitempty"`
	Server   string   `json:"server,omitempty"`
}

Capability is a target-neutral operation that can be represented by one or more supported policy formats. Filesystem selectors name directory roots; renderers add target-native recursive matching where required.

type Catalog 

type Catalog struct {
	Version      string       `json:"version"`
	Principal    EntityRef    `json:"principal"`
	Capabilities []Capability `json:"capabilities"`
}

Catalog enumerates the capabilities Cedar must decide before rendering. Rosetta never invents capabilities that are absent from this catalog.

type CheckRequest 

type CheckRequest struct {
	Source string `json:"source"`
	Mode   string `json:"mode,omitempty"`
}

CheckRequest describes Cedar source validation against the Rosetta profile.

type CheckResult 

type CheckResult struct {
	Valid       bool         `json:"valid"`
	Diagnostics []Diagnostic `json:"diagnostics,omitempty"`
	Errors      []string     `json:"errors,omitempty"`
}

func Check 

func Check(ctx context.Context, req CheckRequest) (*CheckResult, error)

Check parses Cedar and validates every policy against the Rosetta schema.

type CodexMCPServer 

type CodexMCPServer struct {
	Command           string   `json:"command,omitempty"`
	Args              []string `json:"args,omitempty"`
	URL               string   `json:"url,omitempty"`
	BearerTokenEnvVar string   `json:"bearerTokenEnvVar,omitempty"`
}

CodexMCPServer defines the transport for an MCP server whose enabled tools are restricted by Cedar. Set exactly one of Command or URL.

type CodexOptions 

type CodexOptions struct {
	ProfileName string                    `json:"profileName,omitempty"`
	MCPServers  map[string]CodexMCPServer `json:"mcpServers,omitempty"`
}

type CompileMetadata 

type CompileMetadata struct {
	CompilerVersion       string `json:"compilerVersion"`
	CatalogVersion        string `json:"catalogVersion"`
	TargetContractVersion string `json:"targetContractVersion"`
	Mode                  string `json:"mode"`
	InputSHA256           string `json:"inputSha256"`
	ArtifactSHA256        string `json:"artifactSha256"`
}

CompileMetadata identifies the exact Rosetta contracts and deterministic inputs behind an artifact without including policy or catalog contents.

type CompileRequest 

type CompileRequest struct {
	Source  string        `json:"source"`
	Target  string        `json:"target"`
	Mode    string        `json:"mode,omitempty"`
	Catalog Catalog       `json:"catalog"`
	Options TargetOptions `json:"options,omitempty"`
}

CompileRequest describes Cedar translation into a target artifact.

type CompileResult 

type CompileResult struct {
	Output      string          `json:"output"`
	Target      string          `json:"target"`
	Artifacts   []Artifact      `json:"artifacts"`
	Decisions   []Decision      `json:"decisions"`
	Diagnostics []Diagnostic    `json:"diagnostics,omitempty"`
	Metadata    CompileMetadata `json:"metadata"`
}

CompileResult contains generated artifacts and the Cedar decisions behind them.

func Compile 

func Compile(ctx context.Context, req CompileRequest) (*CompileResult, error)

Compile authorizes the requested catalog and renders a deterministic artifact.

type Decision 

type Decision struct {
	CapabilityID string   `json:"capabilityId"`
	Allowed      bool     `json:"allowed"`
	PolicyIDs    []string `json:"policyIds,omitempty"`
}

Decision records how Cedar resolved one catalog entry.

type Diagnostic 

type Diagnostic struct {
	Severity         string         `json:"severity"`
	Code             string         `json:"code"`
	Message          string         `json:"message"`
	Details          map[string]any `json:"details,omitempty"`
	SourceSpan       *SourceSpan    `json:"sourceSpan,omitempty"`
	Target           string         `json:"target,omitempty"`
	RuleID           string         `json:"ruleId,omitempty"`
	Recoverable      bool           `json:"recoverable,omitempty"`
	DocumentationURL string         `json:"documentationUrl,omitempty"`
}

type EntityRef 

type EntityRef struct {
	Type  string   `json:"type,omitempty"`
	ID    string   `json:"id"`
	Roles []string `json:"roles,omitempty"`
}

EntityRef identifies the Cedar principal used for static capability decisions. The type defaults to Rosetta::Principal.

type ExplainRequest 

type ExplainRequest = CompileRequest

ExplainRequest describes a request to explain a compilation.

type ExplainResult 

type ExplainResult struct {
	Explanation string          `json:"explanation"`
	Decisions   []Decision      `json:"decisions,omitempty"`
	Diagnostics []Diagnostic    `json:"diagnostics,omitempty"`
	Metadata    CompileMetadata `json:"metadata"`
}

func Explain 

func Explain(ctx context.Context, req ExplainRequest) (*ExplainResult, error)

type OpenShellOptions 

type OpenShellOptions struct {
	RunAsUser  string `json:"runAsUser,omitempty"`
	RunAsGroup string `json:"runAsGroup,omitempty"`
}

type SourceSpan 

type SourceSpan struct {
	StartLine   int `json:"startLine,omitempty"`
	StartColumn int `json:"startColumn,omitempty"`
	EndLine     int `json:"endLine,omitempty"`
	EndColumn   int `json:"endColumn,omitempty"`
}

type TargetContractInfo 

type TargetContractInfo struct {
	Target   string `json:"target"`
	Version  string `json:"version"`
	Maturity string `json:"maturity"`
}

TargetContractInfo describes the Rosetta-owned output contract for a target.

func TargetContracts 

func TargetContracts() []TargetContractInfo

TargetContracts returns a copy of the target output contracts implemented by this compiler version.

type TargetOptions 

type TargetOptions struct {
	OpenShell OpenShellOptions `json:"openShell,omitempty"`
	Codex     CodexOptions     `json:"codex,omitempty"`
}

TargetOptions controls target details that cannot be inferred from Cedar.

Source Files

View all Source files

Directories

Path Synopsis
cmd
rosetta command
rosetta-server command
internal
api
service

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.