Learn · Rulebooks
Every check a logic rulebook can make
Patterns, ranges, addresses, shapes, and the checks that watch over time.
Checked against the product on · written for people writing code
These are the checks available to a logic rulebook. Each one runs against the fields on an incoming event and answers yes or no.
| Check | What it tests | Example |
|---|---|---|
| shape | That named fields are present and hold the type you expect. | amount is a number and customer.id is text. |
| value: one of | That a field holds one of a set of values. | state is up or down. |
| value: range | That a number falls between two bounds, ends included. | temperature between -10 and 70. |
| value: address range | That an address falls inside a network range. | source address inside 10.0.0.0/8. |
| exact | That a field equals a value, with an option to ignore case. | event type equals link change. |
| compare | Greater than, less than, equal to, different from, starts with, ends with, or matches a pattern. | amount over 10000. |
| present | That a field exists at all, or that it is empty. | approver is missing. |
Join any of them with all, any, none, or one-of to build the test you mean.
Checks that watch over time
| Check | What it tests | Example |
|---|---|---|
| window | A count, sum, average, smallest or largest over recent events. | Eight transfers in an hour. |
| sequence | That one thing happened, then another, within a period. | A permission change, then an export, within ten minutes. |
| absence | That something expected has not arrived. | No heartbeat for fifteen minutes. |
Note. Absence is swept on a timer as well as on arrival. A watched thing that goes quiet never arrives to be checked, and going quiet is the whole point of an absence check.
The bounds every rulebook is held to
Checks are compiled once when a version is published, so the bounds are enforced at that moment and cost nothing while events flow.
| Bound | Limit | Why |
|---|---|---|
| Checks in one rulebook | 256 | Keeps one rulebook readable and its run time predictable. |
| Nesting depth | 32 | A test nested deeper than this is hard for a person to confirm. |
| Pattern length | 512 characters | A long pattern is usually a sign the test belongs in several checks. |
| Pattern shape | Runaway patterns refused | A pattern that can loop on itself would stall the run. It is caught at publish. |
- Does a check ever ask a model?
- No. A check runs as written, with no reading and no outside call. That is why it answers the same way every time.
- What happens when two checks both match?
- Every match is recorded. When they ask for different actions, the most careful action wins.
- Can a logic rulebook use warning labels from a rule pack?
- Yes. A check can raise a warning label, and your rules act on labels from either source the same way.