ek33450505/claude-agent-team
5 stars · Last commit 2026-07-11
Local-first governance layer for Claude Code, built entirely on its native primitives — hooks, subagents, skills, MCP. Turns every session into a queryable, local SQLite record, then reads it back to predict your next dispatch, recall past incidents, attribute cost, and gate commits. The record is the product.
README preview
<p align="center"> <img src="docs/cast-banner.png" alt="CAST — a local-first, data-integrity control plane for Claude Code" /> </p> # CAST [](https://github.com/ek33450505/claude-agent-team/actions/workflows/bats-ci.yml)       > **CAST v9 — "The record that acts."** Claude Code keeps a transcript. CAST keeps a **record** — a complete, local, inspectable SQLite trail (<!-- CAST_DB_TABLE_COUNT -->39<!-- /CAST_DB_TABLE_COUNT --> typed governance tables at `~/.claude/cast.db`) — and then *uses* it: it predicts your next dispatch, recalls the incident you're about to re-cause, attributes your spend per task, and gates your commits. A governance layer built entirely on Claude Code's native primitives — hooks, subagents, skills, permissions, MCP — with <!-- CAST_AGENT_COUNT -->27<!-- /CAST_AGENT_COUNT --> specialist agents that plan, implement, review, test, and commit. Raw `git commit` and `git push` are **hard-blocked** by hooks; every dispatch is recorded. **The record is the product.** Not the agents, not the prompts — the enforcement and the data sovereignty. Every agent failure, every code review, every truncation is captured and usable. The system is honest about its own limits. **[CAST Framework](https://castframework.dev)** · *Keep using Anthropic's native tools. Own the record.* CAST is the system I'd want if I were building production software with Claude Code every day — so I built it, broke it, and hardened it until it earned trust. The hard part wasn't wiring agents together; it was making the platform **honest** (it tells you when work is unverified) and **safe** (it cannot delete its own runtime). Those lessons came from real incidents: a full `~/.claude` wipe (twice) that took out colocated backups, a destructive BATS test that ran `rm -rf` from the repo root unguarded, silent hook failures that ate data without trace. Each incident became an invariant in code: backups live outside the failure domain (Litestream replication to `~/Library`, off the `~/.claude` blast radius); the wipe forensics canary runs from an isolated path so it survives what it detects; a PreToolUse command-guard makes `rm -rf ~/.claude` and `pkill` structurally impossible from an agent; every test runs in a temp HOME, never the real one; and when a hook fails, it records that failure in the `hook_failures` table instead of eating the error silently.