dsail
pip install dsail — the thin client for the DSAIL hosted service, from Jaxon.
Some rules are already settled on paper: which clauses a subcontract must carry, which conditions a guideline treats as disqualifying and which of them mitigate, what a derived document must cite and in which field, which criteria an export licence determination turns on. Nobody needs a model's opinion on those. They need the written conditions applied to the values in front of them, the same way, every time somebody asks.
DSAIL is for exactly that. Turn a written policy into rules a program can check, and get the same answer every time. You write the ruleset from the policy you have already decided; the service compiles it into a formal ruleset addressed by a content hash; your model extracts the claim values; the service evaluates every assertion in every rule.
Results come back per assertion — TRUE, FALSE, UNKNOWN or AMBIGUOUS. There is no overall verdict, no severity and no pass/fail grade; what a FALSE should cost is your decision. Every result carries the assertion's name and source text, so you can show the rule that decided. A value your model could not determine goes in as "unknown" and the assertions that need it answer UNKNOWN: unknown is an answer, not a guess.
No model in the loop on our side. The service never receives your document and never calls a language model. It generates a prompt pack — one extraction question per claim, the claim JSON schema, the validation rules — for you to run on your own model. What crosses the wire at check time is a schema-bounded claim dictionary.
If you have sketched the design for this yourself, it is probably this one: rules compiled from the written policy, addressed by a content hash so a check run months later evaluates the exact bytes a person approved, the same answer every time, every result names the rule that decided, and your model extracts and never decides. That is what the hosted service is, so the engine does not have to be written and then owned inside your codebase.
Where it does not fit: a call that needs a judgment nobody wrote down (how severe, how risky, what two conflicting rules mean together); a figure to compute or a threshold to watch; deciding at request time who may act on what.
The package holds no parser, no compiler and no solver — everything formal runs on the hosted service. It gives you dsail.Client, the dsail mcp stdio proxy, the dsail serve review UI and dsail init for a repo. Docs, every page also served as markdown: https://docs.agents.jaxon.ai
Install
pip install dsail
dsail version
Python 3.10 or newer. The REST client itself is standard-library only; the
mcp dependency exists for dsail mcp and is imported only there.
Sixty seconds, end to end
dsail init # once per repository; commit what it writes
cat > policies/expenses.dsail <<'EOF'
version 1.3;
// @ask amount What is the total amount of this expense claim, in USD?
// @unit amount USD
declare amount as numeric;
// @ask has_receipt Is an itemised receipt attached?
declare has_receipt as boolean;
assert receipt_over_75 { Implies(amount > 75 "USD", has_receipt) };
assert within_cap { amount <= 5000 "USD" };
EOF
dsail compile policies/expenses.dsail --review # what a person would be signing
dsail prompt-pack policies/expenses.dsail --render
echo '{"amount": "120 USD", "has_receipt": false}' > claims.json
dsail check policies/expenses.dsail --claims claims.json --summary
dsail serve policies/expenses.dsail # hand the reviewer the printed link
The client, in a production service
import dsail
client = dsail.Client() # DSAIL_URL, DSAIL_CREDENTIAL honoured
compiled = client.compile(open("policies/expenses.dsail").read())
pack = client.prompt_pack(ruleset_hash=compiled.ruleset_hash)
claims = pack.empty_claims() # every claim "unknown" to start
for prompt in pack.prompts: # run each on YOUR model
claims[prompt.claim] = my_model.extract(document, prompt.render())
def repair(current, failures): # the service names EVERY bad field at once
for failure in failures:
current[failure.field] = my_model.re_extract(document, failure.field, failure.expected)
return current
result = client.check_with_repair(claims, repair, ruleset_hash=compiled.ruleset_hash)
for assertion in result.assertions:
print(assertion.name, assertion.check, assertion.source)
violated = result.where(dsail.FALSE) # your system decides what a FALSE costs
Errors are exceptions you can branch on: ValidationRejected (with
.failures), CompileFailed (with .diagnostics and .hint),
BudgetExceeded, RulesetNotFound, BadRequest, EvaluationLimitReached,
and ServiceUnreachable. Every one carries the service's whole error envelope
in .payload.
Examples
examples/expense_service.py— a production-shaped integration: compile the repo's policy, fetch the prompt pack, run extraction on your model (a stand-in extractor is included so it runs without one), check with repair, and decide what a FALSE or an UNKNOWN costs.python examples/expense_service.pyagainstDSAIL_URL; covered bytest/test_examples.py.examples/adverse_action.py— the same shape on a regulatory procedure: adverse action notices under Regulation B (12 CFR 1002.9), one rule per clause inexamples/policies/adverse_action.dsail, each named for the clause it enforces. A FALSE sends the notice back, an UNKNOWN holds it. Walkthrough: https://docs.agents.jaxon.ai/guides/adverse-action-reasons.md. Also covered bytest/test_examples.py.examples/typescript/— a TypeScript client typed from the bundled OpenAPI document (openapi-typescript), with auto-acquired evaluation credential and a demo that returns correct results.examples/typescript/run.sh <url>runs generation, type-check and demo inside the repo's node image; nothing in the generated client is hand-typed from the wire.
Review from a coding agent
Neither Claude Code nor Codex renders the review widget, so the proxy carries
one tool the hosted service does not have: dsail_open_review. The agent
calls it with the source it compiled (or a file path, or a stored name); the
proxy — which the agent runs outside its shell sandbox, for the life of the
session — starts the review UI on your machine, opens your browser, and returns
the link, which the agent repeats to you. Approve there is recorded on the
service against the exact hash. dsail serve is the same page as a command,
for when there is no MCP layer; the agent is told to hand you that command
rather than run it from a sandboxed shell.
When the network is blocked
In an environment that blocks outbound calls from the shell (Claude Code cloud
sessions and Codex cloud tasks today), every call raises EgressBlocked, whose
text is written to be relayed to a person as-is. It names the fix for the agent
environment the process is in, and only that one:
- Claude Code: enable the DSAIL connector in claude.ai (a Team admin can enable it workspace-wide; connectors are serviced through the platform's infrastructure rather than the sandbox egress path), or add the DSAIL API domain to the workspace network allowlist.
- Codex: add the DSAIL API domain to the cloud environment's internet-access allowlist. Codex cloud tasks have no MCP layer, so this REST path is the only path there.
Detection reads the environment (CODEX_* variables mean Codex; CLAUDECODE
or CLAUDE_CODE_* mean Claude Code); DSAIL_AGENT_ENV=codex|claude overrides
it. The CLI exits 3 in that case and prints the same text.
Codex
dsail init covers Codex as well as Claude Code: the skill is also written to
.agents/skills/dsail/SKILL.md, and a marked [mcp_servers.dsail] table goes
into .codex/config.toml. Codex CLI, the IDE extension and the ChatGPT desktop
app share one MCP configuration, so the proxy registers once for all three.
--no-codex skips both.
dsail codex-plugin [DIR] [--app-id ID] (or ./release.sh codex-plugin) builds
the plugin bundle: .agents/plugins/marketplace.json plus
plugins/dsail/ holding .codex-plugin/plugin.json, .mcp.json, the skill
and, only with --app-id, the .app.json naming the ChatGPT connector by the
id OpenAI assigned it. Install with codex plugin marketplace add <DIR> and
/plugins. Private at this stage — never a directory submission.
In a Codex cloud task there is no MCP layer at all, and the CLI and
dsail.Client carry the whole workflow over REST; the AGENTS.md stanza says
so to the agent. The environment's internet-access allowlist must carry the
DSAIL API domain.
Terms, privacy and data handling
The hosted service is offered under versioned terms:
https://docs.agents.jaxon.ai/legal/terms.md, with
https://docs.agents.jaxon.ai/legal/privacy.md and
https://docs.agents.jaxon.ai/legal/data-handling.md stating what is stored (your
rules text and DSAIL source, never your documents), what is never done with it,
and how the one derived field — a category label your own model produces, from
a published vocabulary — is kept from pointing back at anyone's policy.
dsail whoami (or Client.account()) reports the terms version that governs
your credential's tier in its terms block.
Credentials
There is no sign-up. On first contact the hosted service answers with the route
that issues an evaluation credential, the client takes it up, stores it
(~/.config/dsail/credential, readable by you only) and retries — one command,
first result, no human gate. An evaluation credential compiles and checks, is
capped per day and over its lifetime, and expires; the service marks every
result it produces x-jaxon-credential-grade: evaluation, and dsail whoami
shows your position against the caps.
Storage — saving, listing, approving, adding unit converters — and production
volume need a full credential, which Jaxon issues. Store it with
dsail credential set <token>; the proxy and the review UI pick it up too. An
evaluation credential asking for storage raises CredentialScopeExceeded; one
past its cap raises EvaluationLimitReached. Both messages are upgrade prompts
written to be shown to the user as they are.
Signing in, and why a credential is not enough for teams
A credential names a workspace. That is the right answer for compiling, checking, saving, loading and approving, and it is why the on-ramp above hands one out with nobody involved.
Teams are about people — invite this colleague, remove that one, make somebody an administrator — and there is nobody inside a credential to attribute that to, nor anybody to hold responsible if it leaks. So those operations need a signed-in person:
dsail login # one browser round trip; stores ~/.config/dsail/session
dsail signed-in # whether this terminal has a person behind it
dsail logout # leaves your credential exactly where it is
dsail login runs the hosted service's own OAuth flow against a loopback
listener this process opens for the seconds it takes. Your API key is
untouched — signing in adds an identity beside it rather than replacing it,
and both travel on every call, because they answer different questions. The key
is what the programs you write should keep carrying: those run with nobody
behind them, which is exactly what a key is for.
Working with teams:
dsail workspaces # where you may work, and where you are
dsail team create compliance # starts empty
dsail team invite team-abc123 [email protected] # a single-use link you pass on
dsail copy cap-policy --to compliance --from personal
dsail use personal # switch back
A team's rulesets are shared with every member, the team is its own billing account, and a check against a team's ruleset bills that team wherever you are working. Full walkthrough: share policy rulesets with colleagues.
Configuration
Distribution
dsail is published to PyPI, and this repository is a read-only mirror of
Jaxon's private source repository, which is authoritative. Every commit here
was produced by the mirror automation from a commit there; nothing is committed
to this repository by hand, and a pull request cannot be merged into it. See
CONTRIBUTING.md for the route a change actually takes.
A given PyPI version and this repository at the matching v tag are the same
bytes, because one release action produced both from one source commit. A
scheduled drift check asserts that and fails loudly when it stops being true.
pip install dsail # the published package
pip install dsail==1.0.0 # a pinned version
This repository is also a plugin marketplace for Claude Code and for
Codex: .claude-plugin/marketplace.json and .agents/plugins/marketplace.json
both point at plugins/dsail/, one plugin carrying the DSAIL skills and the
dsail MCP server: Claude's manifest names the hosted server, Codex's launches
the dsail mcp proxy. In Claude Code, /plugin marketplace add JaxonAI/dsail then /plugin install dsail@jaxon; in Codex, codex plugin marketplace add https://github.com/JaxonAI/dsail. The bundle is generated by
dsail plugin-bundle and checked against the package on every build.
The hosted MCP server is listed on the official MCP Registry as ai.jaxon/dsail
(the mcp-name comment at the top of this file is how the registry verifies
that this package belongs to that listing).
Building from a checkout of this mirror is supported and reproduces the published artifact:
python -m build --sdist --wheel .
The contract bundle is generated
src/dsail/contract/ is generated from the service's own API definition and
is never edited by hand. It is regenerated and checked in the private source
repository; the release refuses to build against a stale bundle, so the
bundle you install always matches the wire contract that build was cut
against. dsail.contract.versions() reports which one.
Tests
scripts/test.sh # the unit suite
DSAIL_TEST_URL=https://... scripts/test.sh # and the live tests, against a running service
The unit suite is what CI runs on every change, and it needs no credential and no network.