claude/loop-steering
4 次代码提交
| 作者 | SHA1 | 备注 | 提交日期 | |
|---|---|---|---|---|
 Claude
|
3a6651611f |
loop: cut planner bookkeeping churn + cap diminishing-returns conformance work
Run Tests / Unit Tests (push) Has been cancelled
Run Tests / Etcd Integration Tests (push) Has been cancelled
Lint / golangci-lint (push) Has been cancelled
govulncheck / govulncheck (push) Has been cancelled
Harness (E2E) / Harnesses (mock LLM) (push) Has been cancelled
Harness (E2E) / Provider harnesses (live LLM conformance) (push) Has been cancelled
An assessment of the last 100 commits found ~45% were pure "refresh planner priorities" bookkeeping and much of the rest was thrashing on one weak provider (AtlasCloud text-tool-call repair) and guarding docs the loop already wrote — motion, not progress. Two prompt-policy fixes: PLANNER (planner.md): - Default to NOT committing. Post the assessment and close the issue; open a PRIORITIES.md PR ONLY when the change is MATERIAL (top item changes, an item is added/removed, or a top item's issue closed). No PRs for reorders below the top, reword, or "keep it current" — that churn was the loop's #1 waste. - Add a diminishing-returns guard: don't queue the Nth doc-guard or the Nth robustness workaround for an already-tolerated class; mark exhausted areas needs-human and rank real-headroom capability instead. TRIAGE (triage.md): - Cap the AtlasCloud/plan-delegate tail-chase: another instance of a class the agent already tolerates is NOT filed as a routine patch — comment "recurred — capped" and, if worth more, needs-human. Real regressions (lint/tests/ govulncheck on master) and genuinely new defects still get filed. Prompt-only; reversible. Steers the loop toward outcomes over busy-work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL |
||
|
Asim Aslam
|
ab0bf29c79 |
feat(loop): add a security role that vets for vulnerabilities (#3818)
Adds an opt-in `security` role to `micro loop` and wires it into go-micro's own loop. On a schedule it dispatches the agent to audit the codebase for real, exploitable vulnerabilities and file them. Security gets a deliberately more conservative policy than the other roles, encoded in .github/loop/prompts/security.md: - NEVER auto-merges a security change (fixes stay human-reviewed). - NEVER publishes exploit detail / PoC in a public issue — novel exploitable findings get a concise `security` + `needs-human` issue (class, location, impact) routed to private disclosure; only known/public dep CVEs get a bump PR (no auto-merge). - Weekly by default (`--security-cron`, 0 6 * * 1); tunable. The go-micro prompt targets its real attack surface: MCP/A2A gateways, x402 payments, JWT/wrapper auth, provider BaseURL SSRF + key leakage, the agent tool loop (prompt injection / guardrail bypass), TLS defaults, the loop's own PAT, and dependency CVEs via govulncheck. Note: an agent review is not a gate. The deterministic companion — govulncheck as a required CI check — is a recommended follow-up so known-vulnerable deps can't merge at all. Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Asim Aslam
|
cf790048ad |
loop: triage watches Lint + Run Tests too, not just the harness (#3714)
Backstop for the gate: previously loop-triage only fired on Harness (E2E) failures, so a red lint or test on master (e.g. the misspell that slipped past because golangci-lint isn't a required check) produced no fix issue. Now triage watches all the gate workflows. - micro loop: `--ci-workflow` accepts a comma-separated list of workflow names, rendered into the triage workflow_run trigger as a YAML array; the issue names the actual failed workflow via github.event.workflow_run.name. (generic CLI) - go-micro: regenerate loop-triage.yml to watch "Harness (E2E)", "Lint", "Run Tests"; generalize the triage prompt beyond the harness (a lint/test failure on master is a real regression to fix, not a flake to ignore). - Docs: update CONTINUOUS_IMPROVEMENT.md triage description. Note: this is defense-in-depth. The primary fix is making golangci-lint a required status check so red lint can't merge in the first place — that stays with the human (branch protection). Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Asim Aslam
|
76961d503a |
feat(loop): go-micro runs on micro loop (dogfood its own tool) (#3657)
* feat(loop): go-micro now runs on `micro loop` (dogfood its own tool)
Replace go-micro's five hand-written loop workflows with ones generated by
`micro loop init --roles all`, making "go-micro builds itself with micro loop"
literally true rather than aspirational.
- Generate loop-planner/builder/triage/coherence/release.yml via the CLI with
go-micro's cadence and wiring (planner :59, builder :29, coherence 07:00,
release 23:00; CI gate "Harness (E2E)"; token CODEX_TRIGGER_TOKEN; base master;
tag prefix v). The old loop-architect.yml and loop-devrel.yml become
loop-planner.yml and loop-coherence.yml.
- Move the queue to .github/loop/PRIORITIES.md and add .github/loop/NORTH_STAR.md
(a concise steer pointing to internal/docs/THESIS.md), adopting the loop's
convention.
- Preserve go-micro's rich instructions as editable policy in
.github/loop/prompts/{planner,builder,triage,coherence}.md — the architect
founder-lens + adoption steer, the increment builder, harness-failure triage,
and the DevRel changelog/blog pass — faithfully ported from the old inline
prompts. Behavior is preserved; only the mechanism is now generated.
- CLI refinement the migration surfaced: prompts (and NORTH_STAR/PRIORITIES) are
now write-once — `micro loop init --force` refreshes workflow MECHANICS but
never clobbers customized POLICY. Added renderKeep + a test.
- Update internal/docs/CONTINUOUS_IMPROVEMENT.md (renamed workflows, moved queue,
the prompt-file model, and a note that these files are generated by micro loop).
Verified: build, go test ./cmd/micro/loop/..., golangci-lint (0 issues), gofmt;
`micro loop verify` passes; all generated workflows are valid YAML; re-running
init --force is idempotent and preserves policy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* loop: strip prompt editorial comments before posting to the agent
Verification of the migration surfaced that a dispatch workflow posted the
prompt file's leading <!-- editorial --> header to the agent, and __ISSUE__
inside it got substituted too (e.g. "Keep 4242 literal"). Harmless (invisible
in rendered markdown) but unclean and mildly confusing. The dispatch and triage
body construction now strips <!-- --> blocks with `sed '/<!--/,/-->/d'` before
substituting runtime tokens. Regenerated go-micro's workflows; added a test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
---------
Co-authored-by: Claude <noreply@anthropic.com>
|