writ-approve

A workflow command that advances the current Writ phase only when a separate approval check has created a valid authorization token.

In plain words
What is it for?
Use it to spend an already-created approval token and advance a pending Writ workflow gate.
Why use it?
It prevents a workflow from moving forward when approval was not explicitly detected. The command itself does not decide whether the user's message is approval.

Command for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/infinri/writ/writ-approve
Clone the repo
git clone --depth 1 https://github.com/infinri/Writ

Made for: Claude Code.

Per session 43 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,066 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00043 $0.01066
Opus 5 $0.00022 $0.00533
Sonnet 5 $0.00009 $0.00213
Haiku 4.5 $0.00004 $0.00107

Measured 2d ago against content hash 5aa943550d75, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

writ-approve scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sX POST http://localhost:8765/session/$SESSION_ID/advance-phase \
.claude/commands/writ-approve.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You have been invoked to advance the Writ workflow phase. Confirm the user's intent is to advance, then run this command via Bash.

Authorization: read this before assuming this command is the primary path

This command does NOT detect approval, and it cannot substitute for detection. Step 3 below reads the gate token, and the ONLY thing that writes that token is auto-approve-gate.sh when the user's own prompt classified as an exact approval. So on a detection miss there is no token, this command has nothing to send, and the advance fails closed. The description used to claim this command replaced pattern matching, which was never true of its own procedure.

The detector has three tiers (bin/lib/approval_match.py):

  • exact: the prompt is an approval. The hook mints a bound token and advances the pending gate itself, so this command is usually unnecessary on that turn.
  • embedded: a strong approval word inside a longer sentence, for example "ok remember we want to fix all our findings, approved". Nothing is minted and nothing is advanced. The hook emits a directive naming the pending gate and asks you to confirm the user's intent. ASK; do not call this command to work around it. If the user confirms with "approved", that turn is an exact approval and the hook advances the gate.
  • none: not approval-related. Nothing happens.

Procedure

  1. Check the current phase via GET /session/$SESSION_ID/current-phase. The response also reports next_gate (the gate a token would be bound to) and plan_hash.
  2. If the current phase artifact exists and was presented to the user in this or a prior turn (plan.md for planning, test skeletons for testing, etc.), proceed. Otherwise, respond: "No current phase artifact to approve. Present the artifact first."
  3. Advance via POST, passing the gate token and the working directory. The token at /tmp/writ-gate-token-$SESSION_ID is written by the approval hook ONLY when the user's prompt matched an exact approval pattern, so it proves genuine user approval; the advance route requires it and consumes it (one approval = one advance).

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 72 lines · 43 tokens per session scan A 5aa943550d75

Subscribe to this mod's changes

writ-approve is a command published in the GitHub repository infinri/Writ (189 stars, last pushed 18d ago), licensed MIT. It adds 43 tokens to every session and 1,066 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.