Chapter 29 · Loop Security and Failure Modes

Chapter goals: Master the five safety mechanisms of loops;深读 the official failure mode catalog and design反模式; understand operational concepts like comprehension debt and intent debt; and finally验收 a loop with a production launch checklist.

29.1 Five Safety Mechanisms

Loops amplify the judgments youplant with machine execution power; therefore safety mechanisms are theminimum配置 for production loops, not optional:

1. Path Denylist

The following paths must never be auto-modified by the loop; hitting them必须 escalate to a human:

.env / .env.*
**/secrets/**  **/credentials/**  **/*_key*  **/*_secret*
.terraform/**  k8s/production/**
**/migrations/**          # unless it's a专门 migration loop
auth/**  payments/**  billing/**

Key design: the denylist doesn't rely on "写 a sentence in the system prompt not to modify" to执行; it's enforcedmechanically via the loop-gate tool — loop-gate check --action <type> --paths <files> exits with code 2 on denylist hits,强制 escalation; control scripts can链式 judge.

2. Auto-Merge Allowlist

Default strategy: auto-merge is禁止. Only truly trivial changes才进 the allowlist:

Auto-merge allowed	Absolutely not allowed
Comment/doc typos	Any behavioral change
Lint auto-fix within test files only	Dependency version upgrades
Import排序	Lock file changes
Config within allowlisted docs/ paths	Any denylist path

3. Human Gates

The following scenarios无条件 wait for a human: security/auth/zation-related, payment and PII, infrastructure (Terraform/K8s production), dependency upgrades, a single change exceeding N files (recommend N=10), the third attempt on the same item still failing, and budgetincrease requests.

4. MCP Least Privilege

Connector	Allowed read	Allowed write
GitHub	issues, PR, checks	comments, labels (默认不给 merge)
Linear	team issues	comments, change status (no删除)
Slack	channel history	only to #loop-escalations
Database	—	禁止生产库写入

Use an独立 bot account and a least-scope token; let each loop action be追溯able to the bot identity.

5. Worktree Isolation

All code-writing actions发生 in an独立 git worktree: failure → discard; success →走 the PR流程;配合 loop-worktree to achieve "one attempt per worktree; reject and清扫."

29.2 Official Failure Mode Catalog深读

The official分级 failures by severity into S1 (annoying) / S2 (harmful) / S3 (critical). Five经典形态:

Failure Mode	Symptom	Root Cause	Mitigation
Infinite Fix Loop	The same PR被 auto-fixed 5+ times and stilldoesn't pass	The verifier is too弱 or in the same session as the implementer; only治 symptoms	Hard上限 on attempts (3) → escalate; independent verifier; isolate flaky tests instead of改代码
State Rot	The state file references merged PRs, closed tickets	Not cleaned at the end of each round; multiple loops乱写 the same file	Trim each round; verify IDs are still存活; one state file per模式
Verifier Theater	The verifier "passes" but CI is clearly red	The verification prompt is too vague ("looks good"); never真正 ran tests	The verifier must run tests and贴 the output; change the指令 to "find reasons to reject"
Notification Fatigue	Slack rings every 5 minutes; the teammutes the bot	Notifying every run instead of only on "actionable findings"	Only notify when human决策 is needed; use摘要 mode for reports
Token Burn	The billspikes	Even an empty triage runs the全链路 sub-agents	Exit early if the empty observations list <5k tokens; budget file +熔断器

How to Use

The correct way to打开 this catalog is as adebugging manual: when the loop behavior is异常, first match the symptom to the table; then逐项排查 the mitigation —绝大多数事故 can找到原型 here.

29.3 Design Anti-Patterns: Eliminate Before Launch

Failure modes are "runtimeaccidents"; anti-patterns are "design-phaseerrors." The official lists seven; each has a clear "should do this":

1. Same agent both implements and verifies   → 拆 out an独立 verifier; default stance REJECT
2. No attempt上限                 → Hard上限 3 → escalate with context
3. Triage output is narrative paragraphs    → Structured markdown; one line per item +明确建议 action
4. L1 quality未验证 before L3         → First report-only for a week; let数据 speak
5. Shared state has no schema          → One state file per模式; or clear分区 + trim rules
6. MCP starts with全 write权限        → L1 read-only connectors; earn trust before扩权
7. No stop switch               → LOOP.md写暂停/终止 conditions + budget file

29.4 Comprehension Debt, Intent Debt, and Cognitive Surrender

Loop Engineering provides a set of "operationalvocabulary" to help you名 thoseunclear失控感:

• Intent Debt: each round the agent cold-starts;缺失的项目意图 arefilled by "confident guesses." Skills are the还债方式 —约定 write once, read every round;
• Comprehension Debt: the差距 between what exists in the repo and what you实际 understand. The faster the loopruns, the faster "code you didn't写" piles up — unless you坚持 read what the loopproduces;
• Cognitive Surrender: the mostdangerous trap — letting the looprun, while you停止持有观点. Designing loops requires judgment; using loops to逃避 thinking is an加速器: the same action, opposite outcomes;
• Orchestration Tax: the协调人力 cost of parallel agents — review bandwidth, merge conflicts, context switching. Worktrees解决机械冲突, but the上限 of parallel loops you can消化 is always yourself.

29.5 Operational Points: Slowing Down, Pausing, and Terminating

When to Slow Down / Pause

Slow-down signals: token budget >80% used mid-week | triage false positive rate >30% | the same item escalated 2+ times within 48h
Pause signals: production incident in progress (the loop may interfere with热修) | destructive schema migration in progress | key reviewer on vacation and auto-merge is on

When to Terminate the Loop

Consider杀掉 the loop when any of the following occurs: consecutive S2-level failures; cost高于价值 for two连续 weeks; the team has muteda all its notifications; the模式 has been取代 by an event-driven solution (e.g. pure CI Action).

The termination清单 three steps:

# 1. Stop scheduling: delete the timer / disable Automation / remove the GitHub Action
# 2. Archive the state:标记 the state file as retired
mv STATE.md STATE.retired-2026-06.md
# 3. Post-mortem (optional but stronglyrecommended): write the experience as a story;参考 for next design

29.6 Production Launch Checklist

Converge the content of previous chapters into one验收 form; all checked才允许上生产:

## Loop Launch Checklist
- [ ] Single clear goal +明确的非目标 (what not to do)
- [ ] Triage skill output is structured; description is "boring but specific"
- [ ] Implementer/verifier separated; the verifier真正 runs tests
- [ ] State file has a schema; read/write each round; trim each round
- [ ] Path denylist enforced mechanically by loop-gate
- [ ] Auto-merge default off; allowlist minimized
- [ ] MCP connector least privilege +独立 bot identity
- [ ] loop-budget.md has daily上限 and over-limit actions
- [ ] loop-run-log.md appends a run记录 each round
- [ ] Upgrade trigger conditions are成文 (attempt上限 / risk paths / ambiguity)
- [ ] L1 report period calibrated; false positive rate <30%
- [ ] Termination conditions written into LOOP.md; one-click downgrade anytime

Chapter Summary

• Five safety mechanisms: denylist mechanically enforced; auto-merge default off; human gates unconditional; MCP least privilege; worktree isolation;
• Failure modes graded S1/S2/S3; five classic形态各有对症 mitigation;可用作 debugging manual;
• Seven design anti-patterns eliminated before launch; the core is: verifier separation, attempt上限, structured output, gradual progression;
• Comprehension debt and cognitive surrender are the最大的长期运营敌人 —坚持 read the loop's output;保持 your own观点;
• Slow-down/pause/terminate all have明确 signals and checklists; terminating is not failure; timely止损 is an运营能力.

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. What is the correct enforcement方式 for a path denylist?

2. What are the典型 symptom and root cause of "Verifier Theater"?

3. Regarding "comprehension debt," which statement is correct?

4. When which signal appears does the official recommend "pausing" the loop?

🛠️ Hands-on Practice

1. Copy this chapter's launch checklist into your repo;逐项核对你在第 20 章初始化的 Daily Triage; list the未达标 items and the补齐 plan.
2. Write a gate.yaml for your loop: define 3 path denylists and 1 auto-merge allowlist; verify the hit behavior with loop-gate check.
3. Design a "pre-mortem termination": write down when your loopdowngrades, pauses, and terminates; and the specific command for each step.

All chapters到此结束. Return to the Course Guide to复盘, or继续探索本站其他课程.