Treetop is an open-source authorization stack built on Cedar. It provides tools for building, validating, serving, and operating policy-based authorization.
Run Treetop as a REST service, integrate through an official client, compose deterministic policy bundles, or inspect the service from the command line and browser workbench. The Rust engine can also be embedded for specialized use cases.
The coordinated release adopts declared label ownership by exact Cedar resource type and attribute. Early Treetop releases prioritize correctness over compatibility; ambiguous ownership, deprecated aliases, and old-format defaults are removed. Bundle/module format 2 requires rebuilt and re-signed archives.
The September 6 release shipped Core, Bundle, REST, Rust/Python clients, CLI, and Workbench as 0.1.0; the Go client is 0.3.0 and Bundle Action is v2. See the breaking migration and release set for the new syntax, required consumer updates, published artifacts, and upgrade order.
Core and Bundle 0.2.0 are published with Cedar 4.13.0. The dependency refresh status and migration notes track every repository, release prerequisites, and toolchain changes. The dependency updates are merged; versioned releases beyond Core and Bundle remain separate.
These repositories are all maintained parts of Treetop, covering the runtime, policy delivery, client integrations, and operator tooling.
| Project | Purpose | Distribution |
|---|---|---|
| treetop-rest | REST API and standalone server | server archives · container |
| treetop-client | Typed asynchronous Rust client | crate · docs |
| treetop-client-python | Typed synchronous and asynchronous Python client | PyPI |
| treetop-client-go | Typed Go client | Go package |
| treetop-cli | Command-line client and interactive REPL | native archives and checksums |
| treetop-frontend | Browser workbench for policies, requests, and metrics | static archive and checksum · container |
| treetop-bundle | Deterministic, optionally signed Cedar policy bundles | crate · docs · CLI archives |
| treetop-bundle-action | Policy validation and bundle builds in GitHub Actions | v2.0.0 · releases |
| treetop-core | Rust engine underlying Treetop REST, also available for in-process deployments | crate · docs |
| Artifact | Published formats |
|---|---|
| Treetop server | Linux x86-64 and ARM64 musl archives; container image |
| Treetop CLI | Linux x86-64 and ARM64 musl, Apple-silicon macOS, and Windows x86-64 archives with SHA-256 checksums |
| Bundle CLI | Linux x86-64 and ARM64 musl, Apple-silicon macOS, and Windows x86-64 archives with SHA256SUMS |
| Workbench | Versioned static-site archive with a SHA-256 checksum; Linux AMD64 and ARM64 container image |
| Libraries and clients | Rust crates, Python on PyPI, and versioned Go modules |
| Bundle Action | Versioned GitHub Action; v2.0.0 with the v2 major tag |
Run the server:
docker run --rm --publish 9999:9999 \
--env TREETOP_LISTEN=0.0.0.0 \
ghcr.io/treetop-policy-engine/treetop-rest:latestThen check process liveness:
curl http://127.0.0.1:9999/livezThe action v2 migration explains declared-target syntax and format 2 archives. Action v2 downloads the published Bundle CLI 0.1.0 and verifies its checksum. Pin the reviewed immutable action release commit in protected policy workflows.
Project-specific documentation, examples, current contracts, and release notes live in each repository.