raxit schema

raxit schema prints the embedded JSON Schema (draft 2020-12) for security.yaml to stdout, unchanged — the same schema the CLI itself validates against, so it's always exactly in sync with the running engine version.

Usage

$ raxit schema
{
  "$id": "https://raxit.ai/schemas/security.yaml/v1.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "Source policy surface for the raxIT runtime governance engine.",
  "properties": {
    ...
  }
}

Save it locally for editor autocomplete and CI diffing:

$ raxit schema > .raxit/security.schema.json

Editor autocomplete

Add a yaml-language-server pragma as the first line of security.yaml pointing at the saved schema, and any editor with the YAML language server (VS Code's YAML extension, most Neovim/ Emacs LSP setups) gets inline validation and autocomplete for every block on this site:

# yaml-language-server: $schema=.raxit/security.schema.json
apiVersion: raxit.security/v1
agent: default-agent
default: block
rules:
  - effect: allow
    resource: calc

Flags

raxit schema takes no flags beyond the standard -h/--help.

Gotchas

• The schema is embedded in the binary, not fetched from anywhere — raxit schema's output changes only when you upgrade the engine, not on its own schedule. Re-run it (and commit the refreshed file) after an engine upgrade if you keep a saved copy in your repo.
• The schema documents shape and types; it doesn't replace raxit check/raxit validate for semantic rules (version pins on import:, tenants_enforce requiring a cross-tenant forbid, and so on) — those are enforced at load time, not expressible in JSON Schema alone.