ProvelyRules are optional. With the two lines and no rules file, Provely builds the checks for each agent at run time (just in time), from the tools it finds. Run provely rules review to list and edit each rule.
The static compiler (provely rules scan, review and sign) is for when you want more. Audit the plan before it runs. Share it with your team in git, or in your Provely account with provely rules sync. Make exceptions for an agent or a tool: skip a check, mark a read-only tool, or set a timeout. Some exceptions need a signature.
The review lists each rule, who wrote it, and its status. A change that needs a signature waits until a person signs it.
Rules and markers reach a check run in: TypeScript frameworks (sdks/typescript/src/defenses/runtime.ts:656, commit 5a8f6a6c); Python frameworks (sdks/python/src/provely/frameworks.py:637, commit d4fe6faf); TypeScript plain SDKs (sdks/typescript-instrumentations/src/plain-sdk.ts:249, commit e9aa6a40); Python plain SDKs (sdks/python-instrumentations/src/provely_instrumentations/plain_sdk.py:297, commit e9aa6a40). These callers are not yet in the SDK commit 4112bb06, where the settings and markers come from. On the Python frameworks paths, the grid at commit d4fe6faf passes 5 of 6 rules cases on every path. Read the rules cases. The rules cases are not yet measured at the current heads for: TypeScript frameworks, TypeScript plain SDKs, Python plain SDKs.
Source: Provely plugin source · retrieved 2026-10-17
$ provely rules scan
$ provely rules review
$ provely rules sign
In CI, run provely rules review --check. It exits 10 when a rule does not apply, and it writes a Markdown summary.
What does the review list?
- Each rule, with the agent or the tool it names.
- Who wrote it: your code, the scan, the learner, or a person.
- Its status: applied, waiting for signature, void, or refused.
- For a void rule, the reason: expired, changed code, or unknown name.
Who may sign?
A person with a signing key. provely rules keys manages the keys. A signature from a key that the project does not trust signs nothing.
What happens when the code changes after a signature?
The signed rule becomes void with the reason changed code, and the default holds again. Sign the rule again after you review the change.
Can a signature change any check?
No. Three checks can never change, signed or not. Read the list.
How do rules reach my organisation?
provely rules sync copies rules between .provely and your organisation, by the API key. The rule keeps its signature, and the status rules are the same in every source.