Quickstart: protect a module in five steps

This walkthrough uses the existing yp CLI to inspect a trusted JavaScript module, propose protection, apply supported changes, and run verification.

Run only on trusted code

yp protect plan and yp protect verify can execute project code. This workflow is not a sandbox. Use a disposable test project before applying changes to production source.

1. Initialize

From your own project directory, with the CLI installed:

yp init --yes --target src/paid.mjs
yp doctor

Replace src/paid.mjs with a real file in your project. The CLI creates devpay.json and a generated .devpay/ workspace.

2. Plan

yp protect plan

Read .devpay/plan.json and .devpay/spec.draft.json. The planner may choose:

Decision	Result
AUTO	Supported code is eligible for automatic partitioning
AGENT	Instructions for agent/developer handoff
MANUAL_REVIEW	Stop automatic changes and review

Nothing is applied at this stage.

3. Review and approve

yp protect review

Check the functions being moved, dependencies, unresolved risks, and test vectors. Automatic application requires an approved .devpay/spec.json with no REQUIRES_APPROVAL items.

4. Apply

yp protect apply

The CLI refuses if the approved spec or source hashes have drifted. For an unapproved draft, yp protect apply --approve only permits AGENT/MANUAL_REVIEW handoffs; it does not approve AUTO code transformation.

5. Verify what actually ran

yp protect verify

Inspect .devpay/verify-report.json and .devpay/evidence/. A PARTIALLY_VERIFIED or NOT_VERIFIED result must not be presented as fully verified security.

What's created?

File or directory	Purpose
devpay.json	Project settings
.devpay/spec.draft.json / spec.json	Draft / approved specification
.devpay/plan.json	Hash-bound plan
.devpay/apply-report.json	Applied changes and handoffs
.devpay/verify-report.json, evidence/	Executed checks and evidence

Keep .devpay/ out of version control; it can contain generated secrets.

Next: CLI commands · Protection strategies · 한국어