Quickstart

Download the current complete Rookhold app for your computer:

Computer	App bundle
Windows, 64-bit	Download for Windows
Mac with Apple Silicon	Download for Mac
Linux x86_64	Download for Linux

Contributors can instead run the same version from a checkout:

git clone https://github.com/sambai-dev/rookhold.git
cd rookhold
cargo build --locked -p coop-server --bin rookhold
target/debug/rookhold run python 'print(6 * 7)'

Run the release

Extract it, then run one job. On Windows:

.\rookhold.exe run python 'print(6 * 7)'

On macOS or Linux:

chmod +x rookhold rookhold-cli rookhold-mcp rookhold-verify
./rookhold run python 'print(6 * 7)'

The zero-configuration path starts and stops a temporary loopback service:

42

status       succeeded
network      host
isolation    none
receipt      saved to .rookhold/runs/…/receipt.json

WARNING: isolation is none; this run did not contain untrusted code.

Trusted code only

This local mode is convenient, not contained. It has host networking and the service account's authority. Use it only for code you trust.

Confirm that the local wall-clock deadline works with a deliberate two-second timeout:

rookhold run python 'while True: pass' --wall-seconds 2

The result should report status: timed_out after approximately two seconds.

For untrusted code, connect the same app to a guarded Linux service and require its observed isolation class:

export ROOKHOLD_BASE_URL=https://executor.example
export ROOKHOLD_API_KEY=replace-with-a-scoped-key
rookhold run python 'print(6 * 7)' \
  --minimum-isolation gvisor-application-kernel

That connected run should report network: disabled and isolation: gvisor-application-kernel. Rookhold fails admission if the service cannot satisfy the requested class. The unified CLI explicitly sends limits.allow_network: false with every submission, so the guarded run requires both the network policy and the gVisor boundary instead of inferring either from display text.

Next: install an SDK or deploy the secure Linux boundary.

Finished or blocked? Share a 60-second first-run report. The first unclear step is more valuable than a general review.