Homeostat
Your team's code-review lessons, as rules every coding agent follows.
Your reviewers already teach your coding agents, one comment at a time: "use the retry helper", "never log the request body", "that service was renamed". Each agent forgets by the next session, so the same comment gets written again next week. Claude's own memory helps one person in one tool. It is unreviewed, and it is not shared with the rest of the team or with Cursor, Copilot and Codex.
Homeostat closes the loop:
- It turns review feedback that led to a code change into short, scored rules and living team documents.
- It keeps them in a git repo, one folder per code repo when a team owns several, with rules grouped into topic files. Every change arrives by pull request, and only the uncertain ones need a human.
- It gives every agent the ones that matter for the files it is touching.
Get started
# In a clone of a new or existing repo for your team's knowledge base:
npx --yes [email protected] setup
# Then each developer, once, in their own clone (installs the Claude Code plugin):
npx --yes [email protected] setup --join
setup is a re-runnable checklist: it asks only for what is missing, checks each step with a real call, and stores the CI secrets for you (every step). The quickstart takes you from there to the first daily run in about ten minutes. The full guide starts at docs/index.md.
0.2 adds knowledge bases for several code repos, rules grouped into topic files, and
homeostat bootstrap. Coming from 0.1: moving to 0.2. How it works technically: docs/architecture.md.
How it works
- Start.
homeostat bootstrapbuilds a first base for each repo from its checkout: its existing docs, plus documents on its architecture, conventions, database schemas and infrastructure, in one PR per repo to review. - Capture. Developers add lessons with
homeostat learnor/homeostat:learn, and sessions leave handoff notes. A lesson applies to its author's sessions at once. Each morning a daily run in CI also reads merged PRs, keeps review comments that were followed by a code change, and drafts one rule each with Claude. It also proposes one-section updates to the team documents those comments affect. - Govern. The daily run packs each developer's lessons into one PR a day. It scores every lesson for confidence (its source, the role of whoever vouches for it, how specific it is, flags and conflicts) and decides. Confident lessons merge themselves, weak ones are declined, and the rest go to a review PR for the team's named reviewers (or the area's owners), mentioned in Slack when it is set up. Secrets and risky instructions never merge unreviewed. Developers' sessions sync in the background, with no laptop scheduler and no per-developer setup. The dashboard shows every decision, the review queue, and who is syncing. A weekly deep dive merges duplicates, marks contradictions and retires stale entries.
- Distribute. The Claude Code plugin injects the rules relevant to the files you are touching at session start, within a token budget: the session's own repo's rules plus the shared ones, the document sections that name those files, and a short guide that counts the rest and says when to look things up and how to credit what was used. Every prompt gets a one-line reminder of it. Any agent can use the MCP server.
homeostat exportwrites the same rules and documents as Claude, Cursor, Copilot and AGENTS.md files.
Nothing scheduled runs on a laptop: the agents run in the KB repo's CI (or homeostat up on a shared box).
Commands
Every command also works under the short alias homeo (homeo learn, homeo validate, ...).
The Claude Code plugin is in packages/plugin.
Security and data
The daily run reads review comments, never source code; only bootstrap and seed, run by hand after a preview, send code to a model. Secrets are redacted before any model call and fail validation, so they cannot be merged. A lesson merges unreviewed only above the confidence threshold and with no secret or risky-content findings; risky instructions always go to a human. Model calls can stay in your own AWS or Google Cloud account. docs/data-handling.md is the one-page answer for a security review, docs/security.md is the threat model, and SECURITY.md explains how to report a vulnerability.
Layout
Development
pnpm install
pnpm check # lint + typecheck + tests
See CONTRIBUTING.md.