playrote.play.v1

ppreflight/play-preflightv0.3.3Public

Play preflight

We preflighted all 161 public Plays in the registry.

Read the full description

Every one returns a contract rote marks not fully resolved, and every one reports write_permissions as an empty list. An empty list reads like a guarantee. It only means nobody asked. Preflight tells you what a Play will carry, require and attempt before you grant it process access. It reads rote's own contract via play inspect --json, rehearses the run with rote's non-executing resolver via play run --dry-run, and scans the package itself for captured secrets, hardcoded author paths, and symlinks that escape it. It never executes the target Play, and it does not reimplement rote's contract logic. It asks rote. Run it with no arguments to watch it catch a bundled compromised sample, then point it at anything you are about to trust. Full registry findings ship in the package as REPORT.md. Effect disclosure: rote owns its own installation, workspace and backup behaviour, and running any Play may create rote run workspaces, logs and artifacts. With fetch=true

  • Published 2 Sep 2026
  • Downloads 3
  • Needs rote 0.62.0+
  • Digest sha256:9dcaa7904de9…
  • Reference preflight/play-preflight@0.3.3

Before you run it2 local tools

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

  • ○
    python3local tool

    Must be on your PATH when used. minimum version undeclared.

  • ○
    rotelocal tool

    Must be on your PATH when used. minimum version undeclared.

Inputs2, all optional

rote asks for these before running and shows the defaults it will use.

  • Targettarget

    A local Play path, or an owner/name registry reference. The default, the literal word sample, preflights a deliberately defective Play bundled in this package, so a zero-argument run shows you what a finding looks like before you point this at your own work.

    optionalstringdefault sampleexample modiqo/hellocustom value allowed
  • Download the package firstfetch

    Download the Play from the registry before checking it, so the real package is read instead of only its manifest. This is the half of rote play run that does not execute anything: it puts the Play on your disk and stops. That download is a write. Rote may create package, lock and backup entries under ~/.rote/flows; rote owns that behaviour, not this Play. --no-deps is passed, so no dependency is installed. With fetch=false rote registry play pull is not invoked, though rote may still create its normal run workspaces, logs and artifacts as it does for any Play. A download is only attempted when this owner and name are absent locally and the reference names the current version: rote cannot download a pinned historical version, and an existing installation is yours to manage, not this Play's to replace. Only a package downloaded during this run can be given a verdict about the published artifact. A copy already on disk is still scanned, and its findings still stand, but the published-artifact claim is withheld a

    optionalbooleandefault falsecustom value allowed

What it changes

No write operations are declared in this version's manifest.

Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.

Runtime details
  • rote CLIversion 0.62.0 or newer
  • Servicesnone declared
  • Digestsha256:9dcaa7904de935a73cc9ac8bb756813350c6b0310e7c2f1aa4d6830f273e8e06
  • Archive size23841 bytes
  • Published2026-09-02T09:16:04.410378+00:00
  • Published withrote 0.77.0

Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.

A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.