Rule
A rule is one line of the checklist turned into a sentence that must be true, such as "nothing in the pupil's compiled answer may reach the code that deletes files".
The tool checks the sentence against the map. If the sentence is false, it tells you which part made it false.
What it is
A rule is a condition asserted over the nodes and edges of the program. In ArchUnit it is written in a fluent form that reads close to English, along the lines of no class in this package should depend on that one, and it is evaluated over the imported classes.
A rule that holds produces nothing. A rule that fails must say which node broke it, otherwise the result is unusable on a codebase of any size.
In Ares 2
Rules are generated from the security policy rather than written by hand. Each permitted domain in the policy becomes a rule about which operations may be reached from student code, and every domain that is not permitted becomes a deny rule.
One consequence is worth knowing: a deny-all static rule is added only while a domain has no allowance at all. The moment a domain permits one entry, the static layer can no longer decide the question by itself, because it is argument-insensitive and cannot tell which file or which host a call refers to. The runtime layer becomes authoritative for that domain instead. This is why the example exercises permit exactly one file: it is what makes the negative control exercise the runtime layer.
Further reading
- ArchUnit User Guide — TNG
- Introduction to ArchUnit — Baeldung
- TNG/ArchUnit — source repository