autonomous-loops — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited autonomous-loops (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is a reference skill. It does not run a loop itself — it helps you pick the right autonomous-loop architecture for a task and wire it to this project's existing skills, gates, and CLI tooling. Patterns are ordered simplest → most complex. Use the lightest one that fits.
@rules/git/general.mdc — never push to main, one logical change per commit, English commit messages, worktree/branch per work unit.@rules/code-review/general.mdc to every review stage in a loop — reviewers are read-only and must not be the same context that wrote the code.composer build and composer skill-check are non-negotiable gates between iterations. An iteration that does not pass them is not "done" and must not advance the loop or merge.@rules/git/general.mdc Worktrees / Workspaces.prepare-issue-context).composer build / tests to verify).Lowest complexity. Break the work into ordered, non-interactive steps; each step runs in a fresh context and builds on the filesystem state of the previous one. Order matters and steps exit on first failure.
Use when the task is a single focused change with a known sequence (implement → clean up → verify → commit).
set -e
# branch per work unit per @rules/git/general.mdc — never on main
git switch -c feat/<scope>-<slug>
claude -p "Implement <scope> per <spec>. TDD: failing test first."
claude -p "Review the diff. Remove redundant type/framework tests and over-defensive checks. Keep business-logic tests."
composer build && composer skill-check # gate: must pass before commit
claude -p "Create one conventional commit for the staged changes per @rules/git/general.mdc."Tip: prefer a separate cleanup step over negative instructions ("don't over-test") inside the implement step — two focused agents beat one constrained one.
/loopLow complexity, no script. Use the built-in /loop to re-run a prompt or slash command on an interval (or self-paced). Good for polling and short repeating chores where each pass is independent.
Use when you want a recurring task without authoring a runner: poll PR status, re-run a check, keep an eye on a long job.
/loop 5m run `composer skill-check` and report only new failures
/loop autoresolve-oldest-github-issue # self-paced, one issue per passStill bounded in practice: stop it when there is no open work or a blocker appears.
Medium complexity. This is the project's existing autonomous unit: pick one issue and drive it resolve → review → process-feedback → merge, stopping at any blocker. You rarely need to build this — it already exists.
Use when one tracker issue should be taken from open to merged without a human between steps.
Entry point: @skills/autoresolve-oldest-github-issue/SKILL.md, which chains:
@skills/resolve-issue/SKILL.md — branch, implement, local code-review + security-review loop, pre-push gates, PR.@skills/code-review-github/SKILL.md — review the PR, post findings.@skills/process-code-review/SKILL.md — drive findings to Critical+Moderate == 0.@skills/merge-github-pr/SKILL.md — merge only if mergeable, CI green, approved.The chain processes exactly one issue and stops on the first blocker — never wrap it in a second loop that "retries" past a blocker.
Medium complexity. Run the single-issue chain repeatedly across a backlog, with a shared notes file bridging context between otherwise-independent passes and a hard stop limit.
Use when a labelled backlog (default Resolve_by_AI) should be worked down over a session.
set -e
MAX_RUNS=5; NOTES=.loop/SHARED_NOTES.md # context bridge across iterations
for i in $(seq 1 "$MAX_RUNS"); do
gh issue list --label Resolve_by_AI --state open --limit 1 | grep -q . || break # stop: no work
claude -p "Read $NOTES for prior-pass context. Run @skills/autoresolve-oldest-github-issue/SKILL.md \
for label Resolve_by_AI. Append outcome, decisions, and follow-ups to $NOTES. \
Stop and report if the chain hit any blocker."
doneStop conditions: MAX_RUNS reached, no eligible issue, or a blocker surfaced by the chain. The notes file is what lets pass N learn from pass N-1 despite the fresh context — keep it short and factual.
Highest complexity. Decompose a large spec into independent work units, give each its own git worktree, run each through a complexity-tiered pipeline, and land them through a merge queue that rebases and re-runs gates per unit.
Use when one feature is large enough to split into several units that can progress at once, and only then.
Per work unit: { id, deps, acceptance, tier }. Pipeline depth scales with tier:
composer build/skill-check.code-review.analyze-problem) → implement → gates → code-review + assignment check → fix.Model routing: run implementation on a lighter model, run the review/decomposition stages on a heavier model — the reviewer must be a separate context from the author per @rules/code-review/general.mdc.
for each layer of the dependency DAG (deps satisfied):
for each unit in layer (parallel):
worktree = git worktree add ../wt-<unit.id> -b feat/<unit.id>
run tier pipeline in worktree
merge queue (sequential when worktrees overlap files):
rebase unit branch onto main → composer build && composer skill-check → merge
on conflict / gate failure → evict unit with full context, re-enter next passNon-overlapping units can land speculatively in parallel; overlapping units land sequentially with rebase. An evicted unit re-enters the next pass carrying its conflict/failure context — never force its merge.
composer build then composer skill-check. Both must pass; a failure ends the iteration, not advances it.@rules/code-review/general.mdc); the reviewing context must differ from the implementing context.resolve-issue local review loop, code-review-github, process-code-review convergence, merge-github-pr pre-checks) are authoritative — a loop wrapping them must never bypass or retry past them.composer build and composer skill-check.@rules/git/general.mdc.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.