infinri/Writ
164 stars · Last commit 2026-08-02
A Claude Code plugin that blocks risky writes until a human approves the plan and the tests, then feeds the AI only the rules that fit the file it is touching. Ships with 287 rules across security, architecture, and testing.
README preview
# Writ A Claude Code harness that enforces engineering discipline at the moment the AI acts, and delivers the rules that fit the work in front of it. ## In plain terms Give a coding AI a long list of rules and two things go wrong. It forgets them as the conversation grows, and it has no obligation to follow them anyway. You can ask an AI to write tests before code. Nothing makes it do so. Writ changes where the rules live. Instead of putting them in the conversation and hoping, Writ sits between the AI and your files. When the AI tries to write code before you have approved a plan, the write is refused. Not discouraged, refused. And instead of showing the AI all 287 rules every time it does anything, Writ looks at what the AI is actually doing right now and hands it only the rules that apply. The refusal part is the point. The retrieval part is what makes the refusal affordable when your rulebook grows past a handful of rules. ## The claim, and its limits **The claim.** Instructions in a prompt decay. They get compacted away, outweighed by more recent text, or quietly reinterpreted. A check that runs at the moment the AI calls a tool does not decay. Writ moves workflow discipline to that boundary, where a violation is refused rather than requested, and moves the rulebook out of the prompt into a search system, so the rulebook can grow without the cost of every turn growing with it. **The threat model.** Writ assumes a **cooperative AI**: one that uses its tools in the ordinary way and is not trying to defeat the harness. Under that assumption the gates hold. Against an AI actively working around them, they do not, and the gaps are written down rather than hidden: * Writes made through shell commands are inspected, but a determined workaround (an inline Python one liner, an evaluated string, a heredoc) can slip past the inspector. * When the background service is unreachable, hooks **allow rather than block**. This is the specification, not a bug. An infrastructure outage must never lock you out of your own repository.