feat(writ): demo example — writ.New() + Messages.New + VerifyFull() flow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: OpsKern

examples/README.md

@@ -0,0 +1,19 @@
+# writ examples
+
+## demo
+
+End-to-end flow: `writ.New()` → `Messages.New()` → `VerifyFull()`.
+
+```
+ANTHROPIC_API_KEY=sk-ant-... go run ./examples/demo/
+```
+
+Expected output:
+
+```
+chain: /tmp/writ-demo-chain.jsonl
+response: writ demo ok
+chain verified: 2 entries, root=<hash prefix>
+```
+
+The chain file at `/tmp/writ-demo-chain.jsonl` persists between runs. Delete it to start fresh.

examples/demo/main.go

@@ -0,0 +1,71 @@
+// Demo: writ end-to-end flow.
+//
+// Opens a Merkle audit chain, makes one LLM call through the writ gate,
+// verifies the chain, and prints the result.
+//
+// Usage:
+//
+//	ANTHROPIC_API_KEY=sk-ant-... go run ./examples/demo/
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/anthropics/anthropic-sdk-go"
+	"github.com/opskernel-io/writ"
+)
+
+func main() {
+	if os.Getenv("ANTHROPIC_API_KEY") == "" {
+		log.Fatal("ANTHROPIC_API_KEY is not set")
+	}
+
+	chainPath := filepath.Join(os.TempDir(), "writ-demo-chain.jsonl")
+
+	// Locate the policy directory bundled with this demo.
+	_, thisFile, _, _ := runtime.Caller(0)
+	policyDir := filepath.Join(filepath.Dir(thisFile), "policy")
+
+	client, err := writ.New(writ.Config{
+		PolicyPath: policyDir,
+		AuditPath:  chainPath,
+		CallerID:   "writ-demo",
+	})
+	if err != nil {
+		log.Fatalf("writ.New: %v", err)
+	}
+
+	fmt.Printf("chain: %s\n", chainPath)
+
+	msg, err := client.Messages.New(context.Background(), anthropic.MessageNewParams{
+		Model:     anthropic.ModelClaudeHaiku4_5,
+		MaxTokens: 64,
+		Messages: []anthropic.MessageParam{
+			anthropic.NewUserMessage(anthropic.NewTextBlock("Reply with exactly: writ demo ok")),
+		},
+	})
+	if err != nil {
+		log.Fatalf("Messages.New: %v", err)
+	}
+
+	if len(msg.Content) > 0 {
+		fmt.Printf("response: %s\n", msg.Content[0].Text)
+	}
+
+	result, err := client.VerifyFull()
+	if err != nil {
+		log.Fatalf("VerifyFull: %v", err)
+	}
+
+	if result.Valid {
+		fmt.Printf("chain verified: %d entries, root=%s\n", result.EntryCount, result.RootHash[:12])
+	} else {
+		fmt.Printf("chain INVALID\n")
+		os.Exit(1)
+	}
+}

examples/demo/policy/writ.rego

@@ -0,0 +1,7 @@
+package writ.gate
+
+import rego.v1
+
+default allow := true
+default tier := 2
+default denial_reason := ""