Rules
Architecture rules
Say what each layer of your code may not depend on. When an agent is about to write a file, Threefold reads the imports in what it would write and stops the write that crosses the line.
What a rule is
-
It names some files
By path, with globs: **/billing/domain/**/*.java.
-
It says what they may not import
A persistence layer, an HTTP client, the infrastructure package.
-
And what they may import anyway
The exceptions. The more specific pattern wins.
When an agent asks to write a file a rule covers, Threefold reads the imports in the text it is about to write (for an edit, the new text, not the text being replaced) and refuses the write if one is forbidden. Imports are read from files ending …. A rule in Observe never refuses: it records what it would have stopped, so you can introduce it to every team and read a week of what it flagged before anyone is stopped.
Whose rules
A project that has saved rules of its own is judged against them; every other project is judged against the shared set.
Names are checked here against the stack's default pattern, Acme- and then 1 to 40 letters, digits or dashes, because a name outside it is recorded as unlabelled and would never match the calls you mean to govern.
Draft a rule from a sentence POST /rules/draft
Say the boundary in words. Amazon Bedrock proposes one rule; Threefold checks it as a save would, sets it to observe and tries it on your examples. Nothing is saved until you press Save to project.
Optional: files the rule should refuse or allow. Only each path, what it should do and the imports read in it reach the model; the rest of the file stays with Threefold. Up to two more examples are built from the drafted rule itself.
Rules in force GET /rules
Reading the rules…
Try the rules on a file POST /rules/explain
Nothing is saved and nothing is recorded. Paste a path and what an agent might write there.
Edit the rules POST /rules
The whole set is saved at once and replaces the set it is saved to: the shared set. Written as data so it can be reviewed the way code is.
Each rule
id - what a refusal quotes.
description - the sentence a developer reads when stopped.
mode - enforce (default) or observe.
when_path_matches - globs; ** crosses folders, * does not. Case is ignored.
forbid_imports - System.Data forbids it and everything under it, never System.DataAnnotations.
allow_imports - exceptions. The more specific pattern wins.