Adds an opt-in `security` role to `micro loop` and wires it into go-micro's own
loop. On a schedule it dispatches the agent to audit the codebase for real,
exploitable vulnerabilities and file them.
Security gets a deliberately more conservative policy than the other roles,
encoded in .github/loop/prompts/security.md:
- NEVER auto-merges a security change (fixes stay human-reviewed).
- NEVER publishes exploit detail / PoC in a public issue — novel exploitable
findings get a concise `security` + `needs-human` issue (class, location,
impact) routed to private disclosure; only known/public dep CVEs get a
bump PR (no auto-merge).
- Weekly by default (`--security-cron`, 0 6 * * 1); tunable.
The go-micro prompt targets its real attack surface: MCP/A2A gateways, x402
payments, JWT/wrapper auth, provider BaseURL SSRF + key leakage, the agent
tool loop (prompt injection / guardrail bypass), TLS defaults, the loop's own
PAT, and dependency CVEs via govulncheck.
Note: an agent review is not a gate. The deterministic companion — govulncheck
as a required CI check — is a recommended follow-up so known-vulnerable deps
can't merge at all.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
Backstop for the gate: previously loop-triage only fired on Harness (E2E)
failures, so a red lint or test on master (e.g. the misspell that slipped past
because golangci-lint isn't a required check) produced no fix issue. Now triage
watches all the gate workflows.
- micro loop: `--ci-workflow` accepts a comma-separated list of workflow names,
rendered into the triage workflow_run trigger as a YAML array; the issue names
the actual failed workflow via github.event.workflow_run.name. (generic CLI)
- go-micro: regenerate loop-triage.yml to watch "Harness (E2E)", "Lint",
"Run Tests"; generalize the triage prompt beyond the harness (a lint/test
failure on master is a real regression to fix, not a flake to ignore).
- Docs: update CONTINUOUS_IMPROVEMENT.md triage description.
Note: this is defense-in-depth. The primary fix is making golangci-lint a
required status check so red lint can't merge in the first place — that stays
with the human (branch protection).
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* feat(loop): go-micro now runs on `micro loop` (dogfood its own tool)
Replace go-micro's five hand-written loop workflows with ones generated by
`micro loop init --roles all`, making "go-micro builds itself with micro loop"
literally true rather than aspirational.
- Generate loop-planner/builder/triage/coherence/release.yml via the CLI with
go-micro's cadence and wiring (planner :59, builder :29, coherence 07:00,
release 23:00; CI gate "Harness (E2E)"; token CODEX_TRIGGER_TOKEN; base master;
tag prefix v). The old loop-architect.yml and loop-devrel.yml become
loop-planner.yml and loop-coherence.yml.
- Move the queue to .github/loop/PRIORITIES.md and add .github/loop/NORTH_STAR.md
(a concise steer pointing to internal/docs/THESIS.md), adopting the loop's
convention.
- Preserve go-micro's rich instructions as editable policy in
.github/loop/prompts/{planner,builder,triage,coherence}.md — the architect
founder-lens + adoption steer, the increment builder, harness-failure triage,
and the DevRel changelog/blog pass — faithfully ported from the old inline
prompts. Behavior is preserved; only the mechanism is now generated.
- CLI refinement the migration surfaced: prompts (and NORTH_STAR/PRIORITIES) are
now write-once — `micro loop init --force` refreshes workflow MECHANICS but
never clobbers customized POLICY. Added renderKeep + a test.
- Update internal/docs/CONTINUOUS_IMPROVEMENT.md (renamed workflows, moved queue,
the prompt-file model, and a note that these files are generated by micro loop).
Verified: build, go test ./cmd/micro/loop/..., golangci-lint (0 issues), gofmt;
`micro loop verify` passes; all generated workflows are valid YAML; re-running
init --force is idempotent and preserves policy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* loop: strip prompt editorial comments before posting to the agent
Verification of the migration surfaced that a dispatch workflow posted the
prompt file's leading <!-- editorial --> header to the agent, and __ISSUE__
inside it got substituted too (e.g. "Keep 4242 literal"). Harmless (invisible
in rendered markdown) but unclean and mildly confusing. The dispatch and triage
body construction now strips <!-- --> blocks with `sed '/<!--/,/-->/d'` before
substituting runtime tokens. Regenerated go-micro's workflows; added a test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
---------
Co-authored-by: Claude <noreply@anthropic.com>
Rework `micro loop` so the workflows are the mechanism and each dispatch role's
instruction is an editable .github/loop/prompts/<role>.md file (the policy).
That split lets any repo — including go-micro itself — customize behavior by
editing prompt files instead of forking the CLI, which is the prerequisite for
go-micro consuming its own tool without losing its richer prompts.
- Add two opt-in roles: `coherence` (README/docs/CHANGELOG alignment) and
`release` (cut the next patch tag on new commits; bakes in the
persist-credentials:false fix so the PAT push isn't clobbered by the
checkout token — the 403 we hit on the live release action).
- `--roles` selects which roles to scaffold (default planner,builder,triage;
`all` for everything); `--tag-prefix`, `--release-cron`, `--coherence-cron`
added. Templates keep the << >> delimiters so GHA ${{ }} passes through;
prompts leave __ISSUE__/__RUNURL__ as runtime tokens the workflow substitutes.
- `micro loop verify` now checks each present role workflow has its prompt.
- README updated with the five roles and a copy-pasteable flag example
(folds in the readability fix from the now-closed #3651).
Verified: build, `go test ./cmd/micro/loop/...`, vet, golangci-lint (0 issues),
gofmt; and an end-to-end `micro loop init --roles all` whose generated
workflows all parse as valid YAML and pass `micro loop verify`.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
`micro loop init` writes an autonomous improvement loop into any repository —
the same planner/builder/triage loop that maintains go-micro, generalized:
- planner (loop-planner.yml): keeps a ranked queue in .github/loop/PRIORITIES.md
- builder (loop-builder.yml): builds the top open item as a single-concern PR,
auto-merged on green CI
- triage (loop-triage.yml): turns CI failures into scoped fix issues
plus .github/loop/NORTH_STAR.md (direction) and PRIORITIES.md (queue).
The agent adapter is mention-based, not hardcoded to Codex: `--agent @codex`
(or any @mention agent that responds on an issue and can run gh), `--token-secret`,
`--branch`, `--ci-workflow`, and cron flags are the whole config-vs-core boundary.
Templates use << >> delimiters so GitHub Actions' own ${{ }} expressions pass
through untouched. `micro loop verify` checks the wiring and flags the two things
the CLI can't: the token secret and branch protection (the green-CI gate).
Built inside go-micro with the config/core split already drawn, so the workflows
can later be extracted to a standalone reusable-workflows repo without a rewrite.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
Asim Aslam