Node.js security releases (October 2026): update Node to 22.23.4, 24.22.1 or 26.12.1 before you use yokoten
yokoten
Docs The problem

The guide

The problem

Source: docs/guide.md · v0.1.2

You run a project with AI agents for a few months. You learn things the hard way: an agent “fixes” a failing test by changing the test, a pull request merges with a commit nobody reviewed, a server address ends up in a tracked file. You add a rule, a hook, a check. That project gets better.

Then you start a new project, or go back to an old one, and none of it is there. The lessons live in one repo and in your head. If you forget to ask for them, the agent starts from zero.

yokoten turns those lessons into something that checks itself:

  • Rules with reasons. Twelve core rules. Each one says why it exists (an incident, or a risk if nothing has gone wrong yet) and which check holds it. A rule without a check is a wish.
  • Guards that run on their own. A tool-call hook stops an agent before a bad command runs. A commit check catches what the hook can’t see. CI runs the same check for commits made without either.
  • A reminder you don’t have to remember. Every session starts with doctor. It tells the agent the project’s stage on the road, and the one next step. The agent brings it up, so you don’t have to.