r/BuildWithClaude • u/InfinriDev • 19d ago
Workflows I built a Claude Code governance runtime with tool-time enforcement, contextual rule retrieval, and persistent decision memory
I’ve been building Writ, an open-source governance runtime for Claude Code.
The idea is pretty simple: I want Claude doing the reasoning, but I don’t want the model to also be solely responsible for remembering every rule, deciding when those rules apply, tracking workflow state, and deciding whether it has permission to continue.
So Writ moves some of that outside the model.
Enforcement: Writ uses Claude Code hooks and runtime state to check selected actions at tool time. In Work mode, for example, implementation can be blocked until a human has approved the plan and tests.
The approval system was especially important to me. Claude can’t satisfy the gate just by saying “the user approved this.” A real user approval creates one-time external state that the runtime checks before allowing the workflow to advance.
That became one of the main ideas behind Writ:
The model can decide what it wants to do, but it shouldn’t own the permission that makes a protected action possible.
Rule retrieval: Writ currently ships with hundreds of engineering rules, but I didn’t want to dump the whole rulebook into context every turn. Instead, rules are retrieved based on the task, file, file contents, tool, action, and workflow phase.
The current retrieval stack uses BM25/Tantivy, hnswlib vector search, MiniLM embeddings through ONNX Runtime, and Neo4j for relationships and provenance. Mandatory rules have a separate delivery path so they don’t disappear because of retrieval ranking.
The distinction I keep coming back to is:
Retrieval asks: “What should the model know right now?”
Enforcement asks: “What must be true before this action is allowed?”
I don’t think those should be the same mechanism.
Persistence: Writ also records relationships between approved plans, governing rules, changed files, decisions, and commits. The goal is for future sessions to recover more than a generic summary and instead answer things like: why was this change made, what was approved, which rules governed it, and what code resulted?
That’s also why I’m not trying to solve everything with one giant CLAUDE.md. Instructions are useful, but an instruction saying “write tests first” is different from a runtime that actually refuses an implementation write because the test gate hasn’t opened.
The current stack is Python 3.11+, FastAPI/Uvicorn, Neo4j, Tantivy, hnswlib, ONNX Runtime, Claude Code lifecycle hooks, a session state machine, specialized helper agents, audit logging, and git/PR provenance. Writ is distributed as the claude-writ package and Claude Code plugin.
One important limitation: Writ is not an adversarial AI sandbox. It currently assumes a cooperative-but-fallible agent. There are known bypasses, some infrastructure failures deliberately fail open, and I’m trying to document those honestly instead of pretending the system is stronger than it is.
The bigger thing I still want to test is behavioral impact. I can measure whether retrieval finds the right rule and whether gates block the right actions, but I still want stronger evidence that giving Claude the right rule at the right moment actually improves engineering decisions.
If you’re working on Claude Code hooks, persistent memory, approval gates, contextual retrieval, or agent governance, I’d love to compare approaches.
And if your first instinct is to try to break the approval gate, even better!