Adds an opt-in `security` role to `micro loop` and wires it into go-micro's own
loop. On a schedule it dispatches the agent to audit the codebase for real,
exploitable vulnerabilities and file them.
Security gets a deliberately more conservative policy than the other roles,
encoded in .github/loop/prompts/security.md:
- NEVER auto-merges a security change (fixes stay human-reviewed).
- NEVER publishes exploit detail / PoC in a public issue — novel exploitable
findings get a concise `security` + `needs-human` issue (class, location,
impact) routed to private disclosure; only known/public dep CVEs get a
bump PR (no auto-merge).
- Weekly by default (`--security-cron`, 0 6 * * 1); tunable.
The go-micro prompt targets its real attack surface: MCP/A2A gateways, x402
payments, JWT/wrapper auth, provider BaseURL SSRF + key leakage, the agent
tool loop (prompt injection / guardrail bypass), TLS defaults, the loop's own
PAT, and dependency CVEs via govulncheck.
Note: an agent review is not a gate. The deterministic companion — govulncheck
as a required CI check — is a recommended follow-up so known-vulnerable deps
can't merge at all.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
Backstop for the gate: previously loop-triage only fired on Harness (E2E)
failures, so a red lint or test on master (e.g. the misspell that slipped past
because golangci-lint isn't a required check) produced no fix issue. Now triage
watches all the gate workflows.
- micro loop: `--ci-workflow` accepts a comma-separated list of workflow names,
rendered into the triage workflow_run trigger as a YAML array; the issue names
the actual failed workflow via github.event.workflow_run.name. (generic CLI)
- go-micro: regenerate loop-triage.yml to watch "Harness (E2E)", "Lint",
"Run Tests"; generalize the triage prompt beyond the harness (a lint/test
failure on master is a real regression to fix, not a flake to ignore).
- Docs: update CONTINUOUS_IMPROVEMENT.md triage description.
Note: this is defense-in-depth. The primary fix is making golangci-lint a
required status check so red lint can't merge in the first place — that stays
with the human (branch protection).
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* feat(loop): go-micro now runs on `micro loop` (dogfood its own tool)
Replace go-micro's five hand-written loop workflows with ones generated by
`micro loop init --roles all`, making "go-micro builds itself with micro loop"
literally true rather than aspirational.
- Generate loop-planner/builder/triage/coherence/release.yml via the CLI with
go-micro's cadence and wiring (planner :59, builder :29, coherence 07:00,
release 23:00; CI gate "Harness (E2E)"; token CODEX_TRIGGER_TOKEN; base master;
tag prefix v). The old loop-architect.yml and loop-devrel.yml become
loop-planner.yml and loop-coherence.yml.
- Move the queue to .github/loop/PRIORITIES.md and add .github/loop/NORTH_STAR.md
(a concise steer pointing to internal/docs/THESIS.md), adopting the loop's
convention.
- Preserve go-micro's rich instructions as editable policy in
.github/loop/prompts/{planner,builder,triage,coherence}.md — the architect
founder-lens + adoption steer, the increment builder, harness-failure triage,
and the DevRel changelog/blog pass — faithfully ported from the old inline
prompts. Behavior is preserved; only the mechanism is now generated.
- CLI refinement the migration surfaced: prompts (and NORTH_STAR/PRIORITIES) are
now write-once — `micro loop init --force` refreshes workflow MECHANICS but
never clobbers customized POLICY. Added renderKeep + a test.
- Update internal/docs/CONTINUOUS_IMPROVEMENT.md (renamed workflows, moved queue,
the prompt-file model, and a note that these files are generated by micro loop).
Verified: build, go test ./cmd/micro/loop/..., golangci-lint (0 issues), gofmt;
`micro loop verify` passes; all generated workflows are valid YAML; re-running
init --force is idempotent and preserves policy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* loop: strip prompt editorial comments before posting to the agent
Verification of the migration surfaced that a dispatch workflow posted the
prompt file's leading <!-- editorial --> header to the agent, and __ISSUE__
inside it got substituted too (e.g. "Keep 4242 literal"). Harmless (invisible
in rendered markdown) but unclean and mildly confusing. The dispatch and triage
body construction now strips <!-- --> blocks with `sed '/<!--/,/-->/d'` before
substituting runtime tokens. Regenerated go-micro's workflows; added a test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
---------
Co-authored-by: Claude <noreply@anthropic.com>
The DevRel pass now keeps the changelog living instead of letting it drift:
each daily run reconciles a Keep-a-Changelog `[Unreleased]` section against the
PRs that actually merged (user-facing entries only; internal loop/CI churn
skipped) and rolls it into a dated version heading whenever loop-release cuts a
new v6.MINOR.PATCH tag. When enough user-facing work has accumulated (roughly a
week's worth, not a near-empty post every day) it also drafts a "what's new"
changelog blog post narrating what shipped.
Autonomy boundary preserved: CHANGELOG.md upkeep is a safe factual change and
rides the auto-merged DevRel PR; the changelog blog post is opened as its own
PR but left for the human to review/merge, since blog voice stays with the human.
Also fix the CHANGELOG preamble: it claimed calendar versions (YYYY.MM) while
tags are semver (v6.MINOR.PATCH). Correct it, add an `[Unreleased]` section
seeded from real recent work, and note the historical 2026.0x headings.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
The framework's depth is strong but the on-ramp is the adoption gap, and the
architect queue had filled entirely with internal hardening. Steer the
architect to weight the developer on-ramp/DX (first-agent tutorial,
discoverable examples, docs wayfinding, install friction, debugging) at least
as highly as internal work — a developer succeeding on their first agent
matters more than another conformance/observability increment. Adoption issues
filed: #3561-#3565.
Also add loop-release.yml: a daily patch release that tags v6.MINOR.PATCH+1
when master has new commits (pushed with the PAT so goreleaser fires), so the
installable framework tracks the loop's daily improvements instead of lapsing.
Minor/major bumps stay with the human.
Co-authored-by: Claude <noreply@anthropic.com>
Rename the autonomous-loop workflows so the Actions list maps to the
long-running-agent harness pattern (planner → generator → evaluator):
architecture-review.yml -> loop-architect.yml "Loop: Architect (Planner)"
continuous-improvement.yml -> loop-builder.yml "Loop: Builder (Generator)"
devrel-review.yml -> loop-devrel.yml "Loop: DevRel"
harness-triage.yml -> loop-triage.yml "Loop: Triage (Evaluator feedback)"
harness.yml stays the shared Evaluator/CI gate (triage still matches it by the
"Harness (E2E)" name). Document the pipeline + role mapping in
CONTINUOUS_IMPROVEMENT.md, and point to it from CONTRIBUTING so the development
process is discoverable. No behavior change — schedules, gates, and required
checks are unaffected.
Co-authored-by: Claude <noreply@anthropic.com>
Close the loop's feedback path: when the live provider-conformance harness
fails, harness-triage.yml dispatches Codex to triage the failing run — read
logs, root-cause, dedupe against open issues, and file scoped codex/enhancement
issues that the hourly increment loop then fixes and the next harness run
verifies. Transient flakes are ignored; breaking/architectural fixes are
escalated as needs-human rather than auto-built. No human in the middle short
of a genuine judgment call. Documented in CONTINUOUS_IMPROVEMENT.md.
Co-authored-by: Claude <noreply@anthropic.com>
* ci: run the architect continuously as the founder lens
Make the architect a continuous overseer (hourly at :59, just before the :29
increment) instead of an every-few-days check-in. Each run it tracks live state
(what merged, what's in flight), keeps the roadmap priorities live, and judges
cohesion across harness/framework/dev-UX plus missing pieces and realignment —
re-ranking internal/docs/PRIORITIES.md to match reality. It only opens a PR when
the ranking actually changes (otherwise it just posts an assessment and closes
its issue), to avoid churn.
* thesis: lead the North Star with the mission, grounded in the canon
Instill the years of context the loop was missing: the vision lives in the
corpus (blog, README, website), not a single doc. Lead THESIS.md with an
explicit Mission — "what problem we solve" (make building an agent as easy as
building a service, on one runtime, because an agent is a distributed system),
distilled from the corpus — and name the blog/README/website as the canon the
North Star is a distillation of and must stay faithful to. Wire the architect to
judge every priority against the mission and re-derive alignment from the canon,
flagging drift in either direction (work vs mission, or thesis vs the blog).
---------
Co-authored-by: Claude <noreply@anthropic.com>
The architect now prioritizes the roadmap + an internal scan into a single
ranked, issue-linked queue in internal/docs/PRIORITIES.md (re-ranked each run),
and the hourly increment loop works the top open item from that queue instead
of independently guessing each hour — falling back to its own judgment only
when the queue is empty. So work is roadmap-driven by default and the human can
redirect by reordering the file or its issues.
- New internal/docs/PRIORITIES.md (seeded from the roadmap + open issues).
- architecture-review.yml: architect owns/re-ranks PRIORITIES.md and keeps each
top item backed by a scoped issue.
- continuous-improvement.yml: pick the top open queue item; close both the
priority issue and the run tracker.
- CONTINUOUS_IMPROVEMENT.md: document the architect → queue → increment pipeline.
Co-authored-by: Claude <noreply@anthropic.com>
The hourly loop ships increments but nothing watches the whole. Add two
periodic high-altitude passes, same dispatch mechanism (fresh issue → @codex):
- devrel-review.yml (daily): audits README, website, docs, blog for coherence
with the North Star, README crispness, and blog-worthy material. Safe
alignment/crispness fixes auto-merge; brand/positioning copy and blog drafts
are surfaced in a report for the human, never auto-merged.
- architecture-review.yml (every ~3 days): reviews the framework/harness against
the thesis and files scoped follow-up issues that feed the increment loop. It
does not make breaking/architectural changes itself.
Documented both in CONTINUOUS_IMPROVEMENT.md (Overseer passes).
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* ci: self-merge Codex PRs via native auto-merge; retire the sweep
With branch protection + "Allow auto-merge" now enabled on master, Codex
enables GitHub auto-merge on its own PR (gh pr merge --squash --auto) right
after opening it, so the PR lands the moment the required CI checks pass —
no polling sweep, and the green-CI gate is enforced by GitHub instead of by
gh pr checks in a cron. Removes auto-merge-codex.yml and updates the dispatch
and AGENTS.md accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* docs: document the durable loop mechanics (stub→gh, branch, auto-merge)
Capture the hard-won wiring of the autonomous loop so it isn't re-derived:
fresh issue per increment, user-PAT dispatch (Codex ignores the bot), Codex
opening the PR via gh (make_pr is a no-op stub), unique codex/ branch + label,
and native auto-merge gated by branch protection with 0 approvals. Adds a
"do-not-break" list (don't re-add approvals, don't reuse one tracker issue,
don't use make_pr, don't re-implement during the summary→PR lag).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* website: rename section to "Features"; trim subtitle
Rename the feature-grid heading from "The Runtime Around the Agent" to
"Features", and drop "once they leave the demo." from the subtitle.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
---------
Co-authored-by: Claude <noreply@anthropic.com>
Add internal/docs/THESIS.md — the vision the autonomous loop steers by: a
holistic agent harness AND service framework encapsulating the lifecycle of
services -> agents -> workflows (workloads come after agents; the value is in
composing it into systems that do real work, on schedules and in loops).
Wire it in as the alignment criterion: the continuous-improvement charter and
the Codex dispatch prompt now require every increment to advance the North Star,
so improvements compound toward the thesis instead of drifting locally.
Co-authored-by: Claude <noreply@anthropic.com>
Define the autonomous improvement loop (internal/docs/CONTINUOUS_IMPROVEMENT.md):
full autonomy with correctness (build/test/lint) as the only gate, work sourced
from roadmap + issues + an improvement radar + dogfooding, Claude Code driving
and Codex executing scoped tasks, with brand/positioning and breaking API kept
with the human.
Add a durable scheduled GitHub Action (.github/workflows/continuous-improvement.yml)
as the session-independent backbone — a safe no-op until an ANTHROPIC_API_KEY
secret is added.
Co-authored-by: Claude <noreply@anthropic.com>
Asim Aslam