GitHub - choiyounggi/groundwork: Claude Code Harness • Guardrails hooks • Memory system • Skill architecture • Knowledge loops • Audit logging • Open source foundation · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

choiyounggi

groundwork

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>24 Commits<br>24 Commits

.claude-plugin

.claude-plugin

.github/workflows

.github/workflows

docs

docs

plans

plans

plugins

plugins

.gitignore

.gitignore

LICENSE

LICENSE

README.ko.md

README.ko.md

README.md

README.md

View all files

Repository files navigation

groundwork

English | 한국어

A safe-by-default, batteries-included Claude Code harness — starter pack.

Give an AI coding agent a shell and it will, eventually, try to run rm -rf,<br>pipe a script from the internet straight into sh, force-push over history, or<br>DROP a table. groundwork puts the guardrails and the good habits in place<br>in one install — so the agent stays fast, and stays safe. It even holds in<br>--dangerously-skip-permissions (yolo) mode: a deny still stops the command.

This marketplace bundles three plugins — safety, quality, continuity — you can<br>install together or à la carte:

Plugin<br>What it gives you

guardrails<br>A safe-by-default Bash guard — blocks supply-chain (curl | sh), disk-destroying (dd/mkfs), and fork-bomb commands; asks before rm -rf, force-push, DROP/TRUNCATE, kubectl delete, credential/.env access, cloud-resource deletion, and secret exports. Plus a redacted audit log. Every rule is configurable.

dev-loop<br>A wiki-grounded implementation loop — plan against a semantic-layer best-practices wiki, verify every task (TDD / PDCA / Reflexion), and grow the wiki from what you actually learn. Bigger than one task? orchestrate splits a goal across parallel worker sessions — on Orca when it is installed (tracked tasks, event-driven completion), on plain tmux when it is not — with two human gates around it.

memory-loop<br>A memory lifecycle for your agent — a save gate against hallucinated memories, tiered expiry with archive-not-delete, a periodic learning-review nudge, a habit-distillation frame (HABITS.md), and an optional one-time identity setup (the assistant can even pick its own name).

Install

/plugin marketplace add choiyounggi/groundwork<br>/plugin install guardrails@groundwork<br>/plugin install dev-loop@groundwork<br>/plugin install memory-loop@groundwork

Install just the guard, just the loop, just the memory — or all three.

Why not just a starter template?

Most Claude Code starters scaffold structure. groundwork ships behavior :

Safe by default — the guard is active the moment you install it. Zero config required.

Configurable, not just opinionated — every rule is off / ask / block, per-repo or global, plus your own patterns.

Local-only — commands are matched on your machine. Nothing is sent to a cloud service.

Proven — the hooks are covered by bats tests (a mention of rm -rf passes; an execution is caught) and run in CI.

CC built-in permissions<br>Cloud guardrail services<br>groundwork guardrails

Setup<br>per-session prompts<br>API key + cloud rules<br>install, zero config

Works in --dangerously-skip-permissions<br>no¹<br>varies<br>yes (verified)

Per-pattern rules (rm -rf vs DROP vs curl | sh)<br>coarse<br>yes<br>yes

Team-shared config in the repo<br>limited<br>yes (cloud)<br>yes (.groundwork/)

Commands leave your machine<br>no<br>yes — sent to API<br>no — fully local

Audit log with secret redaction<br>no<br>yes (cloud)<br>yes (local)

Tests / CI<br>yes

Cost<br>free<br>paid tiers<br>free · MIT

¹ Permission prompts are exactly what that flag turns off. A PreToolUse deny is not — see the FAQ.

Try it right after install — /guardrails:self-test feeds real dangerous commands<br>through the guard and shows each block/ask decision, without executing any of them.

See plugins/guardrails/README.md for the full rule list and configuration.

Make it yours

groundwork is a small, honest core you extend — not a walled garden:

guardrails — every rule is off / ask / block, and you add your own<br>extraAsk / extraBlock patterns in .groundwork/guardrails.json, committed and<br>shared with your team.

dev-loop — map its capability roles to your tools with /dev-loop:configure:<br>point verify at your test/build command, knowledge at your own wiki or knowledge<br>MCP, explore at your code search, design at Figma. The bundled best-practices wiki<br>then grows from what you learn via knowledge-flush → reviewed PRs.

memory-loop — your agent's memory and habits stay plain local files you can<br>read and edit; tune the nudge cadence...