steward

Review that holds the line as more people and agents change your code.

Write down the yes/no questions you care about, like “Does every new interactive element work by keyboard?”. On every PR and push to main, Steward checks the code against them and puts findings, with file and line evidence, in the PR thread. It flags first, and only the limits you mark as hard can block.

Install stewardHow it works
How a steward review worksA PR or push to main arrives. Yes/no questions grouped by context each get a score. Low scores become candidate concerns. A check against the code drops false alarms. A finding with file and line evidence lands in the PR thread and is tracked until fixed or dismissed. Flag-first: only hard-limit questions can block.#482pull requestQuestionsAccessibilityStripeDo new buttons work by keyboard?·92Do icon buttons have a name?confirmed in code21Is every webhook verified?false alarm · dropped34Are charges idempotent?HARD LIMIT·887 · Tracked until fixed or dismissedPR thread · #482Steward · AccessibilityIcon button has no accessible name.src/ui/menu.tsx:88✓ fixedFlag-first: findings are comments.Only hard limits can block.Open until fixed or dismissed.

Your questions. Your history. Better every time.

Questions are grouped by shared context, like Stripe or Accessibility. A small model scores each one against your history, a second step checks the low scores against the code and drops false alarms, and Steward tracks every concern until it’s fixed or dismissed.

Example questions, grouped by context.

Analytics

Example questions

  • Do event schemas stay free of drift?
  • Do `capture()` names match `analytics/events.ts`?
  • Do funnel step IDs survive route renames?
  • Do identify calls keep PII out of props?

Stripe

Example questions

  • Do webhook handlers stay idempotent?
  • Does `payment_intent` status stay aligned with invoice status?
  • Do refund paths hit the same ledger write?
  • Do currency codes never silently default to USD?

Auth

Example questions

  • Do JWT claims match the IdP contract?
  • Do session cookies stay HttpOnly and SameSite?
  • Are OAuth callback URLs still allowlisted?
  • Do scopes stay the same on token refresh?

Feature flags

Example questions

  • Do flag keys match the `flags/*.ts` catalog?
  • Do flag defaults stay safe when the SDK is down?
  • Do percentage rollouts respect kill switches?
  • Do removed flags leave no dead `if (flag)` branches?

Observability

Example questions

  • Do span names stay stable across services?
  • Does `traceparent` propagate through every queue edge?
  • Do logs keep the required `request_id` field?
  • Do alert routing keys match service owners?

Notifications

Example questions

  • Do template IDs match `notify/templates`?
  • Do unsubscribe links hit the preference system of record?
  • Do transactional and marketing mail stay on separate streams?
  • Do from-addresses stay on verified domains?

Data warehouse

Example questions

  • Do model contracts avoid silently widening columns?
  • Do PII columns stay masked before leaving prod?
  • Do incremental keys match the upstream primary keys?
  • Do dashboards point at current marts, not raw tables?

Public API

Example questions

  • Do OpenAPI paths match the shipped route table?
  • Do breaking changes bump the major version?
  • Do error envelopes keep the documented `code` field?
  • Do webhook signatures verify with the published secret?

Accessibility

Example questions

  • Does every new interactive element work by keyboard?
  • Do images and icon buttons have accessible names?
  • Do form fields have visible, associated labels?
  • Do modals trap and restore focus?

Permissions

Example questions

  • Does the role-to-permission map stay the system of record?
  • Do UI gates call the same check as the API?
  • Does impersonation write an audit row every time?
  • Do org-scoped IDs stay inside their tenant?

Billing

Example questions

  • Do plan SKUs map 1:1 to entitlement flags?
  • Do seat counts reconcile with the billing provider?
  • Does trial expiry trigger the same downgrade path?
  • Do usage meters match `entitlements/meters.ts`?

Secrets

Example questions

  • Do secret paths match `infra/secrets.manifest`?
  • Do client bundles stay free of secret values?
  • Does staging avoid production secret refs?
  • Do rotation hooks invalidate cached credentials?

Install the GitHub App, connect your agent over MCP, confirm a short code.

Install steward

A review stage that keeps getting better.

Dismissals and fixes feed back into how each question is scored, so the next review is sharper.

  1. 01

    review

    Every PR and push to main.

  2. 02

    score

    Each question, against your history.

  3. 03

    check

    Candidate concerns checked against the code.

  4. 04

    track

    Open until fixed or dismissed.

Agents can install it themselves: llms.txt → /install.

Findings in the PR thread.

Concerns land on the pull request itself, with the reasoning behind each. This example is a real PR review in an earlier comment format.

Steward review (earlier format)
A steward.foo GitHub review on a pull request

Install Steward.

One GitHub App install, one human click. Scoring starts in shadow mode.

Install steward