Use Native Lispex. The commands use Bash, including Git Bash on Windows. Start in a new directory and choose a new output path for each run.
Prepare four files
The input [2, false] means two lines remain below a section heading. Save the rule as house-style.lspx and the input as heading.json. Create the two limit files below in the same directory.
(let ((lines-left (car input))
(chapter-heading? (car (cdr input))))
(if (< lines-left 2)
"deny"
(if chapter-heading? "deny" "allow")))[2, false]prepare-limits.json sets the limits for preparing the rule.
{
"raw_source_bytes": 4096,
"prepare_work": 1000000,
"logical_allocation": 1000000,
"syntax_depth": 64
}evaluation-limits.json sets the limits for evaluating one input and recording
its result.
{
"canonical_input_bytes": 4096,
"eval_work": 1000000,
"logical_allocation": 1000000,
"semantic_frames": 1000,
"traversal_depth": 256,
"output_bytes": 1000000,
"diagnostic_bytes": 1000000,
"transcript_bytes": 1000000,
"transcript_events": 100,
"result_bytes": 1000000
}lispex rule run --source house-style.lspx --input heading.json \
--prepare-limits prepare-limits.json \
--eval-limits evaluation-limits.json --out decision
lispex rule inspect --dir decision
lispex rule verify --dir decision
lispex rule replay --dir decisionAll four commands exit with code 0 and print JSON. These are selected fields from their outputs.
| Command | Output fields |
|---|---|
rule run | "decision": "allow", "category": "semantic-complete" |
rule inspect | "decision": "allow", "executed": false |
rule verify | "status": "verified", "executed": false |
rule replay | "status": "agreed", "fresh_instance": true |
The application supplies the line count and whether this is a chapter heading. allow means the heading may stay. deny means move it to the next page.
| Input | Decision | Reason |
|---|---|---|
[2, false] | allow | Two lines fit below the section heading |
[1, false] | deny | Too little room below the heading |
[5, true] | deny | A chapter heading starts on a new page |
Find the five saved files
rule run writes the complete decision directory atomically. Keep the original
source alongside your input files.
| File | Contents |
|---|---|
prepared.lpxembed | Prepared rule in the prescribed executable format |
canonical-input.lpxvalue | Exact request value in its prescribed byte representation |
result.lpxembed | Result and its link to the request |
receipt-core.lpxreceipt | Portable core linking the rule, input, limits, evaluator, execution transcript, and result |
summary.json | Readable summary of those records |
rule inspect reads the saved data. rule verify checks the exact file set,
identifiers, hashes, and links between records. rule replay runs the request
in a new evaluator instance and compares both the result and portable core.
Malformed or altered records cause a refusal.
Sign and authenticate the decision
This local exercise creates a key pair and a recipient policy from the decision you just checked. Keep the private key outside the decision directory and source control. For separate issuer and recipient roles, follow the typesetting workspace. There, the recipient reviews the public key and accepted rule independently.
lispex key generate --out-dir issuer-key
lispex rule issue --dir decision \
--private-key issuer-key/private.pkcs8.der \
--issuer-label "Publisher A" \
--out issuer-envelope.json
lispex rule policy create --dir decision \
--public-key issuer-key/public.spki.der \
--consumer-label "Print receiver" \
--out recipient-policy.json
lispex rule authenticate --dir decision \
--envelope issuer-envelope.json \
--policy recipient-policy.json
lispex decision issue --dir decision \
--private-key issuer-key/private.pkcs8.der \
--issuer-label "Publisher A" \
--out heading.lpxdecision
lispex decision inspect --bundle heading.lpxdecision
lispex decision authenticate --bundle heading.lpxdecision \
--policy recipient-policy.json
lispex decision replay --bundle heading.lpxdecision \
--policy recipient-policy.jsonEach command exits with code 0. The table lists created files and selected output fields.
| Command | Created file or output |
|---|---|
key generate | issuer-key/private.pkcs8.der and issuer-key/public.spki.der. "status": "generated" |
rule issue | issuer-envelope.json. "status": "issued" |
rule policy create | recipient-policy.json. no standard output |
rule authenticate | package_integrity.status is verified. signature_valid and policy_admitted are true |
decision issue | heading.lpxdecision. "status": "issued" |
decision inspect | "decision": "allow", "executed": false |
decision authenticate | request_binding.status is exact. signature_valid and policy_admitted are true |
decision replay | "decision": "allow", "status": "agreed", "fresh_instance": true |
The .lpxdecision bundle contains seven entries in a prescribed byte format.
They are the five saved files, a manifest listing the contents and metadata,
and the issuer's signed record container. Native issues, inspects, authenticates,
and replays this bundle. npm inspects and authenticates it offline.
Choose the record for your task
Decision authentication checks package integrity, the issuer's signature, acceptance by the recipient policy, and the link to the request. Replay adds a fresh execution result.
Lispex Vouch uses its own signed execution transcripts and a request supplied independently by the recipient. Its local gate checks the current Native execution against the required decision. Your application checks request freshness, prevents reuse, authorizes the business action, and performs it.