Sabline 8.6.0

Sabline

Run code an AI wrote without handing it everything you can reach.

Each function declares what it may touch. You grant the run one folder, one host or a number of calls, and the runtime refuses anything else the moment it's tried.

Formerly Velaris: the project was renamed in 8.6.0, and everything written for the old name still works in 8.x.

Who it is for #

The person about to run a program a model wrote - on a laptop, in CI, behind an MCP server - who wants what it can touch to be bounded by what they said, not by what the program says about itself. It bounds programs written in Sabline, not a Python or shell script the same model might write instead.

See it refuse, in one command #

No arguments, no network, under a minute. It writes the kind of script an agent writes - read ./.env, post it to a webhook - runs it, and shows the refusal, its line and the run's receipt; then the same task inside a budget, and what differs between the two receipts. It writes what it runs, and reads nothing of yours.

Shell
pip install sabline-lang
sabline demo
Text
1. A script that reads ./.env and posts it to a webhook. No budget is given, so it gets io:

   $ sabline agent_script.vel --receipt refused.receipt.json
   line 6: check read_file("./.env") {
   error[E310] 'read_file' needs the 'fs' effect, which this run does not allow (it allows: io)
   exit 1. receipt: refused; E310 (fs) at line 6; grants used: none

2. The same task inside a budget: one file to read, one directory to write, no network:

   $ sabline inside_budget.vel --allow io,fs:read:settings.txt,fs:write:out --receipt allowed.receipt.json
   3 setting(s); the report is in out/report.txt
   exit 0. receipt: ok; grants used: fs:read:./settings.txt x1, fs:write:./out x1

It is not a security boundary by itself: an interpreter in the program's own process enforces the budget. From 8.4 the operating system is asked to hold the same budget under it - fully on Linux, partly on macOS and on Windows. The threat model says what that leaves open.

Try it

Install it and work through the tutorial, about an hour. The playground runs the same compiler in a browser, with nothing installed.

The tutorialThe playground

Review it before running agent code

For a person about to run a program a model wrote. The threat model says what Sabline defends against and what it does not; sabline audit says what one program can touch, before it runs.

The threat modelThe audit

For a model

The whole language as one plain-text page, written to be given to a model before it writes Sabline. Every compiler error names it.

llms.txt

Guides #

Each starts from how people describe the problem, says first what it does not do, and shows a refusal that runs on every push.

Compared, losses first #

Each comparison opens with where the other tool is ahead of Sabline.

Incidents #

The incident catalogue: publicly reported incidents in this lane, each with whether a program of the same shape is refused.

The paper #

Sabline: effects in signatures, budgets at run time, and a baseline for a repository's capability surface - the design, the implementation, and where other work is ahead. PDF.

Install #

Shell
pip install sabline-lang
sabline doctor
sabline new hello && cd hello && sabline main.vel

A standalone executable for Windows, Linux and macOS is attached to every release.

What a signature says #

The promise below is checked for every input before the program runs, and the compiler hands back the input that breaks it:

Sabline
fn discount(price: Int) -> Int
    requires price >= 0
    ensures result >= 0
{
    return price - 10
}
Text
error[E700] promise cannot be kept: 'discount' ensures result >= 0
  proven without running the program: price = 5 gives result = -5

Where things are #