For the morning after a bad run.

velone dev

Local kernel with your policy file. A real microVM on your machine, same rules as production.

velone run

Execute a command or script inside a governed session and stream the decisions.

velone sessions

List, inspect, suspend, resume, fork, and destroy sessions.

velone policy test

Dry-run tool calls against a policy file. Use it in CI to stop a policy regression.

velone policy diff

Structural diff between two policy versions, with the effective privilege change.

velone evidence

Query, show, export, and verify the audit chain.

velone replay

Step through a past session, optionally re-executing in a fresh sandbox.

velone diff

Compare two runs of the same task and show where they diverged.

velone approvals

Watch and resolve pending escalations without leaving the terminal.

velone codex

Run the Codex CLI inside a Velone ring.

# .github/workflows/policy.yml
- run: velone policy test velone.policy.yaml --expect expectations.yaml

# expectations.yaml
deny:
  - tool: shell.exec
    args: "rm -rf /"
  - tool: net.fetch
    target: "*.ngrok.io"
  - tool: db.query
    args: "DROP TABLE"
escalate:
  - tool: stripe.refund
  - tool: email.send

$ velone policy test velone.policy.yaml --expect expectations.yaml

  12 expectations
  ✓ 11 passed
  ✗ 1 failed

  FAIL  email.send should escalate, policy allows it
        introduced in v4 (this change)
        tools.email.send.escalate was removed

$ velone replay session/7f3a --from 4808 --to 4815

  4808  09:14:02  shell.exec    pytest -q tests/           ALLOW   2.4s
  4809  09:14:06  files.read    /workspace/claims.py        ALLOW   0.01s
  4810  09:14:11  net.fetch     api.unknown-host.io         DENY    —
        rule       egress.default
        caller     claims.py:212  →  requests.get(url)
        url        https://api.unknown-host.io/v1/collect
        note       url came from a model completion, not config
  4811  09:14:19  mcp.call      github.create_issue         ALLOW   0.6s
  4812  09:14:27  stripe.refund amount=48200 usd            ESCALATE
        approved   mara@acme  ·  35s  ·  slack
  4813  09:14:31  files.write   /workspace/patch.diff       ALLOW   0.01s

$ velone diff session/7f3a session/9c22

  same   1-6    identical tool calls and arguments
  diff   7      net.fetch
                 7f3a  registry.npmjs.org        ALLOW
                 9c22  registry.npmjs.org.cn     DENY   (egress)
  diff   8      shell.exec
                 7f3a  npm ci                    ALLOW   exit 0
                 9c22  npm ci                    ALLOW   exit 1
  cause  mirror substituted in .npmrc by step 6