pporlock Rules Engine

pporlock Rules Engine A data-flow diagram generated by Archify. 01 / On disk 02 / Load 03 / Compile & register 04 / Assemble 05 / Evaluate module.yaml · manifest + rules · 01 / On disk · declarative module.yaml manifest + rules declarative module.py · optional hooks · 01 / On disk · trusted code module.py optional hooks trusted code rules.yaml · user file rules · 01 / On disk · state_dir rules.yaml user file rules state_dir ModuleLoader · never raises · 02 / Load · MOD-005 ModuleLoader never raises MOD-005 compile_rule · action · match · 03 / Compile & register · ruleset.py compile_rule action · match ruleset.py TransformRegistry · built-ins + cost · 04 / Assemble · PXY-024 TransformRegistry built-ins + cost PXY-024 ModuleContext · ctx API per module · 04 / Assemble · SPEC-0 §8 ModuleContext ctx API per module SPEC-0 §8 ModuleRegistry · active module set · 03 / Compile & register · registry.py ModuleRegistry active module set registry.py State sidecar · enabled · priority · 02 / Load · state_dir State sidecar enabled · priority state_dir RuleSet · phase-partitioned · 04 / Assemble · MOD-023 RuleSet phase-partitioned MOD-023 Evaluator · six phases · 05 / Evaluate · PXY-020 Evaluator six phases PXY-020 Provenance · every outcome · 05 / Evaluate · CAP-010 Provenance every outcome CAP-010 file rules file rules parse manifest parse import; top level runs trusted each rule per rule LoadedModule MOD-005 enabled · priority · config user state CompiledRule[] compiled build + combine assembled ctx per module python tier register_transform extension point priority, then index ordering hooks run last hooks apply(kind, text) body phase outcome + duration structural Legend primary data policy / PII async batch data store data flow

The DSL: what a rule is

  • • name, action, match, params. The action fixes the phase: block, map_local, redirect short-circuit; headers run on request or response; body runs last
  • • match compiles once: host glob, path regex, method, dest, query, headers; status and content type only on response-phase rules, else a load error
  • • Order is module priority, then declaration index. First match wins for short-circuits; header and body rules all apply

The Python tier

  • • Hooks: on_load, on_unload, on_request, on_response, on_websocket_message, on_report, on_config, each with a per-module ctx: matches(), config, store, assets, synthesize(), register_transform()
  • • Hooks run after the declarative rules of the same phase and see the transformed body, so the tiers compose rather than race
  • • A raising hook is attributed and ignored; repeated failures quarantine the module. Code is trusted, unsandboxed, and dry run executes it

Where to extend

  • • New transform: a TransformSpec in build_registry with its params and Cost class, plus the cost table
  • • New action: the Action enum, ACTION_PHASE, _validate_params, an evaluator apply path, and the rule schema in contracts/
  • • examples/modules/ is the conformance suite; validate_module reports line numbers before anything loads