Skip to content
Shape
Abstract glass conformance aperture with coherent blue paths and a rejected red diagnostic trace.

Typed system memory

Shape

Agent-drafted architecture claims, human-reviewed and deterministically checked.

Start with Shape Read the model

Shape gives a codebase a small human-readable model in .shape files. Humans and LLMs write reviewable claims about resources, components, effects, ownership, structural relations, changes, and refactor constraints. The deterministic checker accepts or rejects those claims.

The checker does not prove that application code is correct. It checks whether the declared architecture model is coherent enough to enforce in review and CI.

Shape review loop showing code diff, agent draft, .shape claims, human review, source evidence, unknowns, shp check, CI gate, and diagnostics.

The first demo

Section titled “The first demo”

An append-only resource can allow reads and appends while forbidding final destructive effects:

module audit


trait AppendOnly<T: Resource> {
  allow Append<T>
  allow Read<T>
  forbid final DropStorage<T>
  forbid final HardDelete<T>
  forbid final Truncate<T>
}


resource AuditEvent : AppendOnly


component AuditStore {
  owns AuditEvent
  grants Append<AuditEvent>
  grants Read<AuditEvent>
  fn appendEvent
    effects complete {
      Append<AuditEvent>
    }
}

If a change adds a function whose shape summary says it hard-deletes AuditEvent, Shape rejects the model before the change becomes architectural fact.

Shape can also require typed design context before accepting non-obvious function shapes. A refactor-sensitive function can require a matching memory, and guarded changes to that function can require a recorded reevaluation.

What to read first

Section titled “What to read first”