OpenCode Loops

Kickoff preview

Run the project tests, inspect failures, fix the smallest root cause, and repeat until the test command passes. Do not weaken the tests or change the check command.
Goal: Make the selected test command pass without weakening coverage.
Check command: pnpm test
Exit condition: The test command exits successfully with no failing tests.
Max iterations: 8
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not delete, skip, or mark tests as todo unless explicitly requested.

Kickoff preview

Verify the deployed URL, critical pages, sitemap, robots, and metadata. Fix or report exact failures before declaring the release successful.
Goal: Confirm the deployed site responds correctly and key pages are usable.
Check command: curl -I $DEPLOY_URL
Exit condition: Critical deployed pages return expected status and visible content/metadata.
Max iterations: 4
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not claim deployment success based only on build success. Verify the deployed URL.

Kickoff preview

Before committing, inspect the staged diff, scan for secrets/debug flags, run relevant validation, and only commit if the guard passes.
Goal: Block commits that contain secrets, debug switches, or unverified broken code.
Check command: git diff --cached --check
Exit condition: Staged diff is clean, no obvious secrets/debug flags are present, and relevant validation passes or is explained.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not commit secrets, local env files, debug flags, or generated private artifacts.

Kickoff preview

Scan changed and staged files for secrets, local env files, and debug leaks. Remove or redact unsafe values and repeat until clean.
Goal: Prevent secrets and local credentials from leaving the working tree.
Check command: git diff --cached | rg -n "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA|BEGIN OPENSSH)"
Exit condition: No unapproved secrets or local credentials are present in staged or changed files.
Max iterations: 4
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Never print raw secrets in the final answer. Redact values if they appear in output.

Kickoff preview

Run the Cloudflare build, verify the deployed Worker URL, D1-dependent pages, sitemap, robots, and static assets. Report exact failures.
Goal: Prove the Cloudflare Worker deployment is serving critical routes with correct bindings.
Check command: pnpm cf:build
Exit condition: Cloudflare build and deployed smoke checks pass.
Max iterations: 4
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not expose Cloudflare tokens or account IDs in public output.

Kickoff preview

Audit all environment variable references, classify public vs secret scope, compare env templates and deployment config, and report missing or unsafe variables.
Goal: Ensure required env vars exist in the right place and secrets are not exposed client-side.
Check command: rg -n "process.env|import.meta.env|VITE_" src .env.example wrangler.example.jsonc
Exit condition: All referenced env vars are documented and correctly scoped.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Never move server-only secrets into public `VITE_` variables.

Kickoff preview

Run audit, review safe remediation paths, update targeted dependencies, verify build/tests, and report remaining vulnerability risk.
Goal: Remediate actionable vulnerabilities without unsafe forced upgrades.
Check command: npm audit --audit-level=high
Exit condition: No high/critical audit findings remain, or remaining findings are documented with blockers.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not run force upgrades without explaining breaking-change risk and receiving approval.

Kickoff preview

Upgrade dependencies in small safe batches, review install-time scripts, run build/tests after each batch, and document remaining breaking changes.
Goal: Upgrade dependencies without breaking the app or ignoring supply-chain risk.
Check command: pnpm build
Exit condition: Selected dependency batch is upgraded and validation passes.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not blindly install packages without reviewing install/postinstall/prepare scripts.

Kickoff preview

Monitor the PR checks, inspect failing logs, fix the smallest root cause, push, and continue until CI passes or a real blocker is reported.
Goal: Turn failing CI logs into a verified fix or clear blocker report.
Check command: gh pr checks --watch
Exit condition: The failing CI check is fixed, or a blocker is documented with log evidence.
Max iterations: 6
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not paste secret-bearing logs into public output. Redact tokens and credentials.

Kickoff preview

Triage the flaky test: re-run narrowly, estimate reproduction, inspect nondeterminism sources, patch or document quarantine, and verify repeatedly.
Goal: Diagnose flaky behavior without hiding it.
Check command: pnpm test -- --runInBand
Exit condition: The flake has a likely cause, a verified fix, or a documented quarantine recommendation.
Max iterations: 6
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not delete or skip flaky tests just to make CI pass without documenting risk.

Kickoff preview

Audit release rollback readiness: risky files, migrations, previous deployment path, data safety, and feature flags. Do not execute destructive commands.
Goal: Know how to safely revert the release before shipping it.
Check command: git diff --name-only main...HEAD
Exit condition: Rollback path is documented and destructive/irreversible changes are explicitly acknowledged.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not run destructive migrations or rollback commands without explicit user confirmation.