The Bulwark

Claude Code is remarkably capable. But capability without consistency is its own problem. Left unguarded, AI-assisted work skips type checks, ships reviews that miss what a single pass can't catch, writes tests full of mocks that assert calls instead of behavior, and produces estimates that swing wildly from one session to the next. And it isn't just the code: the thinking that precedes it (the research, the plan) tends to be ad-hoc and unreproducible too. The gap isn't the model's ability. It's the absence of guardrails that make quality automatic instead of something you have to remember to ask for.

Two kinds of work, same builder. People who want to stay in the driver's seat while handing Claude semi-autonomy over structured workflows: solo developers and small teams on Claude Max or Enterprise who need AI-assisted work to be repeatable and auditable, not a black box they trust on faith. Part of what they hire it for is the code: ship AI-written work they can actually stand behind. Just as much is the thinking before the code: research a space, pressure-test the approaches, and turn an open question into a plan that still holds up when they pick it up weeks later.

Defense in depth, across two workflows.

The thinking (non-coding). The Bulwark runs research, brainstorming, and planning as multi-agent pipelines, no code involved. bulwark-research spawns five parallel agents, each taking a different viewpoint, and merges them into one synthesis. bulwark-brainstorm and plan-creation run in two modes: sequential for well-understood topics, or Agent Teams where roles debate in real time and a Critic challenges assumptions as they form. plan-creation puts a four-role scrum team on the problem (PO, Architect, Eng Lead, QA/Critic) and produces phased work packages; plan-to-tasks turns that plan into an executable tasks.yaml with a file per work package.

The building (coding). A Claude Code plugin with three enforcement layers: 30 skills, 15 custom agents, 8 hooks. Rules inject at session start and hold throughout. Hooks run type, lint, and build gates after every write, so bad code is caught the moment it lands, not at review time. Skills orchestrate multi-agent pipelines: a code review that spawns specialized agents (security, type safety, standards, synthesis), a test audit that catches mock abuse, an analyze-fix-verify lifecycle for bugs. Session handoffs are deterministic, so context survives from one session to the next.

The bridge (spec-drift check). Plans outlive sessions. A work package authored in session 1 might not get implemented until session 30, and by then the ground has moved: the codebase changed, decisions were superseded, assumptions expired. There will be drift. So the Bulwark runs a spec-drift check at the start of every work package, validating the current state against the original spec before a line of code gets written. Drift gets caught and reconciled up front, not discovered halfway through an implementation built on a stale plan.

Open-sourced under MIT, published to npm and the Claude Code marketplace, currently at v1.3.0. Enforcement runs on its own: gates block bad writes, multi-agent review catches what single passes miss, drift gets reconciled before implementation, and sessions hand off without losing state. Adoption is growing by word of mouth, tracked in the open through clone and download charts that update daily. It's early, and the roadmap is public: language-aware review, an evaluation framework for skills and agents, brownfield codebase onboarding.