Shape

How it works

• 📝

  Decisions as text

  Claims live in .shape files next to your code. People and agents write them, and reviewers read them in the pull request like any other change.

• ⛔

  Rules that can't be waived

  Mark a resource append-only and hard deletes are rejected outright. No grant anywhere in the model can override a final forbid.

• 🧭

  Governed code

  Declare which folders the model covers. Change them without updating the model, or recording why it didn't need to change, and the check fails.

• 🕸️

  Dependency rules

  State which way dependencies point, who may provide an endpoint, and which cycles are forbidden. CI holds the line.

• 🧠

  Design memory

  Record why fragile code looks the way it does, and which changes to it need a fresh review.

• 🤖

  Built for coding agents

  A Claude Code plugin adds skills that read the model before an edit, review diffs against it, and flag contracts that quietly loosen.

A failing check

Audit events are append-only, so a purge job that hard-deletes them is rejected, even though its own component grants the delete.

module audit

resource AuditEvent : AppendOnly

component AuditStore {
  owns AuditEvent
  grants Append<AuditEvent>
  grants HardDelete<AuditEvent>
  fn appendEvent
    effects complete {
      Append<AuditEvent>
    }
  fn purgeOldEvents
    effects complete {
      HardDelete<AuditEvent>
    }
}

$ shp check
error: forbidden effect

AuditStore.purgeOldEvents emits HardDelete<AuditEvent>.
AuditEvent has trait AppendOnly.
AppendOnly forbids final HardDelete<AuditEvent>.

Shape checks the claims, not the code: shp reads only .shape files and never runs your source. Tests, typechecks and review still decide whether the code matches the model. Shape makes sure the model itself holds together, and that it changes alongside the code.