continuous-agent-loop

Canonical patterns for continuous autonomous agent loops with quality gates, evals, and recovery controls. Supports sequential, RFC, CI/PR, and exploratory l...

Security Scan

The skill and its included audit script are coherent with the stated purpose (repo/agent harness auditing); no unrelated credentials, network calls, or install-time downloads are present, though there are a few small bookkeeping inconsistencies to note before running it.

Purpose & Capability

The skill provides patterns for continuous agent loops and ships a deterministic harness audit script that scores repos. The required env var AUDIT_ROOT aligns with the script's need for a target root path. One minor mismatch: SKILL.md tells users to run `node scripts/harness-audit.js` but the skill's metadata does not list `node` under required binaries.

Instruction Scope

Runtime instructions direct the agent to run the included Node script which enumerates and reads files under the provided root and also probes common plugin locations under HOME. This is expected for an audit tool, but the script can read arbitrary files under AUDIT_ROOT (and looks at HOME for plugin manifests) so the operator should avoid pointing AUDIT_ROOT at sensitive system locations.

Install Mechanism

No install spec or remote downloads are used; this is an instruction-only skill with a bundled JS script. No external code is fetched at runtime, lowering install-time risk.

Credentials

Declared required env var is only AUDIT_ROOT, which is proportional. The script also reads process.env.HOME (typical) to look for plugin installs; HOME wasn't declared but is an OS-provided variable. The script reads repository files (package.json, hooks, agents, etc.), which is expected but means secrets present in the audited path could be read and included in output.

Persistence & Privilege

The skill does not request permanent/always-on presence, does not modify other skills or system config, and has no install-time persistence. It can be invoked autonomously by the agent (normal default), but has no extra privileges.

Assessment

This skill appears to do what it says: run a deterministic repository harness audit. Before running it, confirm you have Node installed (SKILL.md uses `node` but the metadata doesn't list it), and set AUDIT_ROOT to the intended repository path (do NOT point it at `/` or other sensitive directories). Review scripts/harness-audit.js yourself if you need stronger assurance — it reads files under AUDIT_ROOT and probes HOME for plugin manifests, so outputs may include any readable files in those locations. Run with `--format json` for machine-readable results, and consider running in a sandboxed environment if you're auditing an unfamiliar repo.

Patterns for autonomous agent loops with quality gates and recovery.

Loop Selection

Choose your loop type based on requirements:

Need strict CI/PR control? 
  → continuous-pr

Need RFC decomposition?
  → rfc-dag

Need exploratory parallel generation?
  → infinite

Default → sequential

Production Stack (Recommended)

1. RFC decomposition — break large requests into a DAG of sub-tasks before looping
2. Quality gates — define explicit pass/fail criteria before starting each loop iteration
3. Eval loop — run automated checks after each iteration to verify progress
4. Session persistence — checkpoint state between iterations so you can resume on failure

Key Patterns

Sequential Loop:

• Single task → execute → verify → repeat
• Best for: stable, incremental work
• Recovery: freeze, audit, reduce scope

RFC-DAG Loop:

• Decompose request → parallel branches → merge results
• Best for: complex multi-part features
• Recovery: replay failing unit

CI/PR Loop:

• Generate → test → push PR → merge on pass
• Best for: code-heavy deliverables
• Recovery: fail fast, surface root cause

Infinite/Exploratory:

• Generate variants in parallel, filter winners
• Best for: creative or search-heavy work
• Recovery: cap iterations, tighten criteria

Failure Modes & Recovery

Problem	Root Cause	Fix
Loop churn	Vague acceptance criteria	Freeze & redefine criteria
Repeated retries	Same root cause ignored	Run harness audit (see scripts/harness-audit.js), fix root
Merge queue stalls	Test flakes or deps	Isolate failing unit
Cost drift	Unbounded escalation	Cap token budget per loop

Recovery checklist:

• Freeze loop
• Run node scripts/harness-audit.js — scores 7 categories (tool coverage, quality gates, evals, security, cost efficiency, memory, context)
• Reduce scope to failing unit
• Replay with explicit criteria

References

• scripts/harness-audit.js — deterministic audit script, scores repo 0-70 across 7 categories
• references/harness-audit.md — full command usage and output contract