As Decided v0.26.0 — Deterministic code enforcement

As Decided v0.26.0 is out. Decisions can now block deterministic code violations, not merely explain them after the fact.

This release makes Sentry operational across the native engine and CI:

• decided sentry checks source changes against machine-readable constraints carried by accepted decisions.
• decided gate --code composes code enforcement into the existing merge gate.
• Pull requests receive blocking SARIF findings through the native Sentry job.
• Rules remain local and deterministic: required patterns, forbidden patterns, and bounded import checks.

No embeddings. No model call. No network judge. No llm_judge: true escape hatch.

The Core corpus is also dogfooding the capability:

• Corpus adoption: 20 of 121 live decisions explicitly classified (16.53%)
• Eligible enforcement: 20 of 20 eligible decisions constrained (100%)
• Active rules: 46
• Still unclassified: 101

Those numbers are deliberately separate. As Decided does not infer that an unclassified decision is enforceable, and it does not add decorative regexes to improve a percentage.

The first rules cover security and trust boundaries, deterministic evaluation, merge protection, MCP compatibility, truthful OKF export, mapped persistence, freshness fallbacks, incremental validation, deterministic parallel construction, cache defaults, Linux event acceleration, and base-plus-delta generations.

Example

version: 1
eligibility: eligible
reason: "The dependency boundary is deterministic and repository-local."
rules:
  - id: domain-has-no-database-driver
    kind: forbid_import
    path_glob: "src/domain/**/*.rs"
    pattern: "^(sqlx|diesel)(::|$)"
    message: "Domain code must not import a database driver."

Run it directly:

decided sentry decisions --repository . --base origin/main

Or include it in the existing gate:

decided gate decisions --code --repository . --base origin/main

Install

brew install asdecided/tap/asdecided-core

Existing Homebrew installations can upgrade after the formula update:

brew update
brew upgrade asdecided-core

Native release archives for Linux, Apple Silicon macOS, and Windows are attached automatically after publication.

This is deterministic enforcement where the constraint is honestly machine-checkable. Decisions that still require human review remain visible as such.