Typesetting Rule Workspace

Create a decision bundle for a heading placement rule. The publisher signs it and the printer checks it against independently reviewed source and input.

Use Native and Bash. In a new directory, save house-style.lspx, heading.json, prepare-limits.json, and evaluation-limits.json from Run and Check Decision Records. Keep private keys outside the files you send.

Prepare each party

The recipient reviews the rule and the [2, false] input independently. This exercise runs both roles locally. The recipient's own run supplies the accepted rule and evaluator identities for its policy.

lispex rule run --source house-style.lspx --input heading.json \
  --prepare-limits prepare-limits.json \
  --eval-limits evaluation-limits.json --out publisher-decision
lispex key generate --out-dir publisher-key
lispex key inspect --public-key publisher-key/public.spki.der
lispex rule run --source house-style.lspx --input heading.json \
  --prepare-limits prepare-limits.json \
  --eval-limits evaluation-limits.json --out reviewed-decision
lispex rule policy create --dir reviewed-decision \
  --public-key publisher-key/public.spki.der \
  --consumer-label "Print receiver" --out recipient-policy.json

All commands exit 0. The two runs print a decision of allow and create their five-file decision directories. Key generation creates private.pkcs8.der and public.spki.der and reports generated. Key inspection reports valid. Policy creation writes recipient-policy.json without standard output.

In a real exchange, the printer obtains the public key through its chosen review channel. It chooses the source, input, and executable independently of the incoming bundle.

Inspect the saved files

The publisher's run writes prepared.lpxembed, canonical-input.lpxvalue, result.lpxembed, receipt-core.lpxreceipt, and summary.json into publisher-decision. Keep the source and input alongside these records.

lispex rule inspect --dir publisher-decision
lispex rule verify --dir publisher-decision
lispex rule replay --dir publisher-decision
lispex decision policy check --policy recipient-policy.json

All four commands exit 0 and print JSON. These are selected output fields.

Inspection reads the saved records. Verification checks their file set and links. Replay creates a fresh evaluator instance and compares the result and portable core. The core records the rule, input, limits, evaluator, and result.

Send and replay the decision

lispex decision issue --dir publisher-decision \
  --private-key publisher-key/private.pkcs8.der \
  --issuer-label "Publisher A" --out heading.lpxdecision
lispex decision inspect --bundle heading.lpxdecision
lispex decision authenticate --bundle heading.lpxdecision \
  --policy recipient-policy.json
lispex decision replay --bundle heading.lpxdecision \
  --policy recipient-policy.json

All four commands exit 0 and print JSON. Issuance creates heading.lpxdecision and reports issued. Inspection reports decision as allow and executed as false. Authentication reports signature_valid and policy_admitted as true, with an exact request binding. Replay reports agreed and fresh_instance as true.

The application decides whether to place the heading after receiving the result. Keep the exact source, input, bundle, and recipient policy together in the job record. Keep the private key with the publisher.

Issue Vouch from a rule image

Complete the separate Vouch exercise in another directory. It prepares print-handoff.lspx, input.checked.json, policy.json, and the issuer key. The input contains four inspection results and the final file revision edition-final.

Keep ISSUER_KEY_URI set to that issuer's absolute private-key location. Run these commands in the Vouch directory, using new output paths.

lispex image encode --source print-handoff.lspx --out print-handoff.lspx.png
lispex image inspect --image print-handoff.lspx.png
lispex vouch source-id --source-image print-handoff.lspx.png
lispex vouch issue --source-image print-handoff.lspx.png \
  --input input.checked.json --profile csk.checked-profile/v1 \
  --key-handle "$ISSUER_KEY_URI" --out-dir image-issued --emit-bundle
lispex vouch gate --bundle image-issued/vouch-input-bundle.json \
  --trust-policy policy.json --source-image print-handoff.lspx.png \
  --input input.checked.json --profile csk.checked-profile/v1 \
  --require-decision approve --report-out image-gate.json

All five commands exit 0. Encoding creates print-handoff.lspx.png and prints its image summary. Inspection prints the image summary again. source-id prints the same source identifier as the text file.

Issuance and the gate print nothing. image-issued contains issue-report.json, payload.json, envelope.dsse.json, and vouch-input-bundle.json. The issue report records issued-native. These fields come from image-gate.json.

Vouch starts from its own rule and checked input. The recipient chooses its own policy and supplies the source image and input independently. The application authorizes the print job after a fresh gate.

For a specific job, follow What Your App Does After a Decision. It signs all nine values, adding the request ID, actor, action, and expiry. Keep its request bundle separate from the five-value practice bundle.

Inspect the supplied workspace

Native also provides workspace status for the repository's fixed examples/refund-workspace example. From the repository root, create a separate empty directory for its result slots.

mkdir -p ../workspace-status-work
lispex workspace status --dir examples/refund-workspace \
  --work-dir ../workspace-status-work

Both commands exit 0. The status command prints JSON with workspace_integrity equal to manifest-match, an empty candidate_invocations array, and all eight result slots marked absent.

The command resolves each root supplied through --dir and --work-dir once to its real path before opening it. It rejects links below either root and links introduced into the resolved path before opening. The status JSON contains no absolute root paths.

A present-unchecked slot means the named object exists. Authenticate the record and run a fresh gate for the request before the application authorizes an action.

This command accepts the fixed manifest and inventory of the supplied example. A newly created typesetting directory produces workspace-manifest-invalid and exits 3. For the typesetting files above, use rule verify, decision authentication and replay, and the Vouch gate shown in this guide.