CI on Rune

Flint

Flint is Scheme CI policy on Rune for trusted workloads on one Linux machine. Read the workflow tutorial, operator prerequisites, command reference, and safety limits.

Preview contract. These operational guides describe unreleased source, not a shipped-release or deployment claim. Match your build's help and bundled skill before using commands. Check compatibility.

CI policy written in Scheme

Flint is a private CI server for trusted workloads on one Linux machine. Workflow compilation, scheduling, leases, retries, recovery, and interfaces are Scheme policy running on Rune. Rune supplies the bounded native effects. There is no standalone Flint Rust binary or separate Flint installer in this contract.

This is preview documentation for unreleased source. It is not a Flint 1.0 acceptance or availability claim. Use an existing authorized Flint source project or imported capsule with a matched Rune host. This site does not distribute candidate source or promise that a public Rune download contains it.

Native jobs use Linux namespaces, cgroups, and overlayfs. These help cleanup and reproducibility. They do not make hostile repositories safe. Flint is not an arbitrary multi-tenant runner or a production LLM, chat, or A2A host.

Check the host and operator prerequisites

  • A Rune build that matches the preview contract and a compatible Flint project, with permission to use Rune under the applicable license.
  • A supported Linux machine for native jobs, with cgroup v2, user, mount, PID, and UTS namespaces, and overlayfs usable by the Flint service account.
  • An operator-managed root filesystem with the tools the jobs actually need, a delegated cgroup, and private native-state storage. These are not created by a workflow file.
  • Approved resource pools, process selectors, content, outbound authorities, repository mappings, and credentials when the chosen workload needs them.

macOS can support Scheme development and control-plane checks on a compatible Rune build. macOS checks are not successful Linux jobs and are not 1.0 acceptance. Missing native authority is an expected blocker, not a reason to disable the safety policy.

The checked-in Flint runtime.toml disables the HTTP listener. Public exposure, TLS, authentication, webhook secrets, and status publication need explicit operator configuration. No guide here activates an operator service.

Choose a Flint guide

Tutorial

Inspect and run a sample workflow

Start with an existing project, validate the Scheme, then inspect a two-job JSON workflow on a prepared Linux host.

 How-to

Manage resources and failed runs

Understand provider setup, read logs, replay a terminal run, and diagnose cleanup failures.

 Reference

Look up workflow and interface contracts

Find commands, supported workflow fields, operator settings, HTTP envelopes, and MCP limits.

 Explanation

Understand trust and recovery

Read why policy, native authority, durable state, and publication are separate.

New to the host runtime? Begin with Rune help. Its platform matrix and maintainer capsule limits also apply to Flint.

Back to top