It refuses
to say you passed.
Rule of Code turns your engineering constitution into a gate that cannot be quietly disarmed. When it has checked 5 of 169 laws, it will not print COMPLIANCE — it prints the number and exits non-zero.
npm install -g ruleofcode A missing gate you know about.
A disarmed gate gives you confidence — that's what kills you.
Real output. A config had quietly narrowed the set to 5 of the 169 laws in the register. Everything was green. The tool printed the number anyway and refused to report compliance. Today's audit is here.
What it is
A linter tells you the quotes are wrong. This tells you the gate lied.
Rule of Code is a CLI that audits a codebase against 169 constitutional laws across TypeScript, Angular, Node and Python. It is not a linter and not a scanner. It is the thing that refuses to certify what it did not check.
It won't certify a subset
Run it with a config that silently narrows the set to 5 laws and it prints Total Laws Checked: 5 and fails. Coverage is reported, never assumed. A gate that reports PASSED over a subset is the bug this product exists to kill.
Every law says what it can't see
Each law carries its own detection limits — the sentences that state what it does not claim. Silence is never coverage. Where limits aren't declared yet, the site says so, publicly, with a counter.
The tool is judged by its own law
This site publishes its own audit on every deploy — passes, visible debt, waivers and their reasons. If the audit fails, the deploy fails. No competitor does this, because no competitor dares.
Get started
From nothing to a blocking gate in five minutes.
No account, no service, no telemetry. It's a CLI and a config file. A kid writing their first Angular project gets the same gate that guards a bot trading real money.
Install the package
A dev dependency, nothing more. It runs no script on install — it does not read your repository until you ask it to. Pin it like any other gate you rely on.
npm install --save-dev ruleofcodeWrite the constitution
Writes ruleofcode.config.json with all the laws enabled and detects your stack. Nothing is enabled behind your back — read the file it wrote.
npx ruleofcode initRun the audit — and read the number
Prints how many laws actually executed, how many count toward the liveness floor, what passed, what failed, and why. Exits non-zero on failure so CI cannot ignore it.
npx ruleofcode audit --mode=fullArm the hooks
Installs pre-commit and pre-push gates that run the FULL law set — never a fast subset. A hook that checks less than your CI is a disarmed gate with good manners.
npx ruleofcode reinstall-hooksPareto mode · --mode=fast
27 laws. 16% of the set. It still refuses to call it compliance.
You don't want 169 laws on every keystroke. Pareto mode runs the high-impact core — 27 laws — so the inner loop stays fast. What makes it ours is the second half: the tool tells you it ran a subset, before it tells you anything else, and it will not dress the result up as a verdict.
“The laws that do not run cannot pass.”
Real output, captured. Even the fast path answers to the liveness floor — when the selection collapsed, it refused rather than reporting a green subset.
And here is what the fast path cannot see.
4 of the 11 categories have zero laws in the Pareto core. We publish this because a feature that hides its blind spot is the same lie as a gate that hides its coverage.
PYTHON — 0 of 37
The fast path runs none of it. If this is your stack, --mode=full is not optional — it's the only mode that sees your code.
PERFORMANCE — 0 of 11
The fast path runs none of it. If this is your stack, --mode=full is not optional — it's the only mode that sees your code.
Sacred laws — in the core
The sacred laws are in the Pareto core. If the fast path stays green, the things that end companies are still watched. That's the 80/20 — stated, not implied.
The register
169 laws. Every one of them says what it does not claim.
The register on this site is generated from ruleofcode laws --json at build time. Nobody transcribes 169 laws by hand — if the generator fails, the build fails. These are the real counts, today.
Findings
We show you the bugs we shipped, not just the ones we catch.
A tool that hides its own failures is precisely the tool you shouldn't trust. These are real, from our own field reports.
The metric that fed nothing
A team ran a bot with real money. Their docs claimed “✅ alert policy”. The unauthorized_401 metric fed nothing — zero alert policies in the cloud. The bot could have died in silence. Our law said “alerts not configured”. They went and looked.
The law that demanded a lie
One of our own laws required a 90%-ticked checklist committed to the repo — it required teams to claim they'd verified things they hadn't. A consumer refused to lie and reported us. We fixed the law.
The gate that disarmed itself
A regression of ours shrank the pre-commit set from 122 laws to 27 — quietly. Nobody noticed, because everything was green. That is the exact failure this product exists to prevent, and we shipped it.
Open source · MIT
The commands on this site stopped being a promise.
Until now, every ruleofcode command on these pages assumed you had our tarball. As of v7.23.0 the gate is public: one command away, MIT-licensed, source in the open. Read every law's detector before you trust it — that's the point.
The source on GitHub (opens in a new tab)
Every law's detector, every test, every release — in the open. The audit you run is the audit you can read.
MIT · issues welcome — we publish our own bugs, rememberruleofcode on the registry (opens in a new tab)
The package behind every command on this site. It installs 2 commands: ruleofcode and roc.
v7.23.0 · MIT · npm install -g ruleofcodeSame gate, same numbers
The published package is what audits this site on every deploy — the /dogfood numbers come from it, not from a private build.
verify us: roc audit — on our repo, or yoursThe version, licence and command names above are read from the installed package when this page is built — never hand-written. If the package that produced the 169 laws is ever not the one named here, the build fails instead of publishing the difference.
In production · listed with the owner's permission
Trust is the wrong word. They verify us.
One consumer so far, named with permission — and they never took the gate on faith. Three findings on our wall are their reports. That's what this list is for: not logos — receipts.
Automated trading platform — crypto & CME futures. Bots trading real money ship through this gate: pre-push audits, liveness floors, zero waivers.
wordmark reproduced as rendered by their product · with permissionTheir audit runs at zero waivers
93 laws enforced on their futures backend — 0 failed, 0 waivers. Debt stays visible until it's fixed; nothing is argued away.
their own report · July 2026 · numbers theirs, not oursThey found the metric that fed nothing
Our law said "alerts not configured". Their team went and looked — and found a metric no alert policy consumed, on a bot trading real money. F-01 on the wall.
They refused a law that demanded a lie
When one of our laws rewarded a pre-ticked checklist, their team refused to tick it and reported us instead. We fixed the law because of them. F-03 on the wall.
How this list grows: a named consumer, their written permission, and at least one verifiable story on the wall. No gray logo walls, no "trusted by" without receipts — a logo you can't verify is exactly the artifact this product exists to kill.
Documentation
The docs are the product.
Every page is prerendered, searchable offline, and versioned in git. No page here makes a claim it can't prove on the spot.
Dogfood
This site is judged by its own law. If the audit fails, the deploy fails.
Not a badge. The real, current output — how many laws ran, what passed, what is visible debt, what is waived and with what justification. Numbers are generated at deploy and are never written by hand.
Emitted by the audit at build time — if the generator or the audit fails, the build fails. Never hand-written. See the full audit →
The reward
One thing it gives you for free. You cannot fake it.
Most days this tool tells you no. But when every applicable law passes — all of them, not a fast subset, not a narrowed config — it prints a unicorn.
--unicorn flag. No --force. It is printed on exactly one condition — auditResult.passed — and there is no other code path that reaches it. audit-engine.ts at build time. Rendered as real text — select it, copy it. We didn't screenshot our own unicorn. Every other page on this site shows you what refusal looks like.
This is the other side of it. Earn it.
::
;.:: ::
:.:: ::::
::.:; .; :::::
;...;x . +;+:. ::::::
;::;;;;X .::+;;;::; .:::::;:
:::+;;+++X+ ;++;;;::; :.::::::: .:
+:;+;;+;;; ;+;+: :: :..:. ::::: ::...
;;++;;++++; +;+:.:; :.... :::::: .::. .:
+;;+x. . ;+;:::.;. .. .:: :::. .::.... .:;:
:x; X:; ;;;:::..;.. .: .;;; ..::.. ...::;:::::
: +; +;:::...: .:. .:;;.. ... ::::::::::
; .. +;::...:;+.. .:..;. .::;:.. ..::::::::::::
: +;::..;:;;; .:..:. .:::. ...:..;:::::::::::
; : ;;;;..;::;;;. .; ;:...:.. ...::::::::::::
;:. . :;:; :+;;;x::;;: .: .::. ..::...:::::::::::.
: .. : ; :+;:;:::;;:.;. ::: ..:::::::::::
: ;+;:;:::;;;:;. ::.. .::.... :::::::::::
: ;+;:;;:::+;;+: .;:. ...::;::::::::
:;; ; ;+;:;;;:::;;;+. .:.. ..... .::::::::::
: : x; ;;;X;;;:::;;+; ::. .....:;;:::::::..
: . : :.+;: ++. ;;;:::++; ::. ..... . .:::::::::
.+ ; :;;;+Xx;x;;:::+; .::. . ... .:::::::;:
: : :. ; +;;:;;. ... .. ..::::::::::
: : : .. :;;: : . .:.. ..++;::::::
:. .;: .+: ;;: .: .:. .:;::::::
::::;;+ .; ;+ .:.::....:;:: :
:+x+: ; ;+++++
; :;; :+:..++++
. :;::;+++++:. : .+..;++;
: ; :: :;; :: : ;+..;+++
. : :: .:; ++;::.:+++
+ . .;.. ++;;:;..++;;
+ ;;X : ::;: ;+;;;:;..+++x
+;:;++ . :. ;+;;;;:...++;;.
+:;++ . ; X;;;;;::..;+;;;;;
;; .. : X;;;;;:. ...++;;;;;+:
: .+ x;;;;+;;:::...:+++;;;;;:
; : : .+;;;;;;;::::... :+++;;;+.
. . . ;x;;;;;;;;;:::.....;++;:+
: : .. . ++;;;;;;;;:::.....+; ;
x . : : ;x+;;;;;;::... :+;:;.
+:::++: : : :++;;;:;....+;;+
;+++x: . .. :x;:;...:+;;;
; : +. .;;:... +;;;
:;::;++ ;..::;++:....:+;;+
:+;;+; +;........;+;;+
:+++++++++.