From bffe391ea35645a64d4485d93acc3a4d6d157b6a Mon Sep 17 00:00:00 2001 From: shixi-li Date: Thu, 23 Jul 2026 14:48:09 +0800 Subject: [PATCH 1/2] docs: add Cursor CI Sweeper example --- examples/README.md | 2 +- examples/cursor/README.md | 3 +- examples/cursor/ci-sweeper.md | 99 +++++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+), 2 deletions(-) create mode 100644 examples/cursor/ci-sweeper.md diff --git a/examples/README.md b/examples/README.md index 7f09e12..de0ca45 100644 --- a/examples/README.md +++ b/examples/README.md @@ -25,7 +25,7 @@ Start with [primitives-matrix.md](../docs/primitives-matrix.md) to map capabilit |---------|------|--------|-------|----------|--------|----------|----------|--------|------------| | Daily Triage | [grok/daily-triage.md](./grok/daily-triage.md) | [claude-code/daily-triage.md](./claude-code/daily-triage.md) | [codex/daily-triage.md](./codex/daily-triage.md) | [openclaw/daily-triage.md](./openclaw/daily-triage.md) | [cursor/daily-triage.md](./cursor/daily-triage.md) | [windsurf/daily-triage.md](./windsurf/daily-triage.md) | [opencode/daily-triage.md](./opencode/daily-triage.md) | [hermes/daily-triage.md](./hermes/daily-triage.md) | [github-actions/daily-triage.yml](./github-actions/daily-triage.yml) | | PR Babysitter | [grok/pr-babysitter.md](./grok/pr-babysitter.md) | [claude-code/pr-babysitter.md](./claude-code/pr-babysitter.md) | [codex/pr-babysitter.md](./codex/pr-babysitter.md) | [openclaw/pr-babysitter.md](./openclaw/pr-babysitter.md) | [cursor/pr-babysitter.md](./cursor/pr-babysitter.md) | [windsurf/pr-babysitter.md](./windsurf/pr-babysitter.md) | [opencode/pr-babysitter.md](./opencode/pr-babysitter.md) | [hermes/pr-babysitter.md](./hermes/pr-babysitter.md) | [github-actions/pr-babysitter.yml](./github-actions/pr-babysitter.yml) | -| CI Sweeper | [grok/ci-sweeper.md](./grok/ci-sweeper.md) | [claude-code/ci-sweeper.md](./claude-code/ci-sweeper.md) | [codex/ci-sweeper.md](./codex/ci-sweeper.md) | [openclaw/ci-sweeper.md](./openclaw/ci-sweeper.md) | — | — | [opencode/ci-sweeper.md](./opencode/ci-sweeper.md) | — | [github-actions/ci-sweeper.yml](./github-actions/ci-sweeper.yml) | +| CI Sweeper | [grok/ci-sweeper.md](./grok/ci-sweeper.md) | [claude-code/ci-sweeper.md](./claude-code/ci-sweeper.md) | [codex/ci-sweeper.md](./codex/ci-sweeper.md) | [openclaw/ci-sweeper.md](./openclaw/ci-sweeper.md) | [cursor/ci-sweeper.md](./cursor/ci-sweeper.md) | — | [opencode/ci-sweeper.md](./opencode/ci-sweeper.md) | — | [github-actions/ci-sweeper.yml](./github-actions/ci-sweeper.yml) | | Post-Merge Cleanup | [grok/post-merge-cleanup.md](./grok/post-merge-cleanup.md) | [claude-code/post-merge-cleanup.md](./claude-code/post-merge-cleanup.md) | [codex/post-merge-cleanup.md](./codex/post-merge-cleanup.md) | [openclaw/post-merge-cleanup.md](./openclaw/post-merge-cleanup.md) | [cursor/post-merge-cleanup.md](./cursor/post-merge-cleanup.md) | — | [opencode/post-merge-cleanup.md](./opencode/post-merge-cleanup.md) | — | [github-actions/post-merge-cleanup.yml](./github-actions/post-merge-cleanup.yml) | | Dependency Sweeper | [grok/dependency-sweeper.md](./grok/dependency-sweeper.md) | [claude-code/dependency-sweeper.md](./claude-code/dependency-sweeper.md) | [codex/dependency-sweeper.md](./codex/dependency-sweeper.md) | [openclaw/dependency-sweeper.md](./openclaw/dependency-sweeper.md) | [cursor/dependency-sweeper.md](./cursor/dependency-sweeper.md) | — | [opencode/dependency-sweeper.md](./opencode/dependency-sweeper.md) | — | [github-actions/dependency-sweeper.yml](./github-actions/dependency-sweeper.yml) | | Changelog Drafter | [grok/changelog-drafter.md](./grok/changelog-drafter.md) | [claude-code/changelog-drafter.md](./claude-code/changelog-drafter.md) | [codex/changelog-drafter.md](./codex/changelog-drafter.md) | [openclaw/changelog-drafter.md](./openclaw/changelog-drafter.md) | — | — | [opencode/changelog-drafter.md](./opencode/changelog-drafter.md) | — | [github-actions/changelog-drafter.yml](./github-actions/changelog-drafter.yml) | diff --git a/examples/cursor/README.md b/examples/cursor/README.md index 479ccc2..f39cfee 100644 --- a/examples/cursor/README.md +++ b/examples/cursor/README.md @@ -7,6 +7,7 @@ Copy-pasteable loop patterns for Cursor, using **Automations** (cloud cron) or m | Daily Triage | 1d–2h (Automation or manual) | Low | [daily-triage.md](daily-triage.md) | | Constraints | Every loop run (before triage) | Low | [constraints.md](constraints.md) | | PR Babysitter | On cadence (Automation or manual) | Medium | [pr-babysitter.md](pr-babysitter.md) | +| CI Sweeper | 15m or failing-check trigger; report-only first | Medium | [ci-sweeper.md](ci-sweeper.md) | | Dependency Sweeper | 6h report, patch-only after tuning | Medium | [dependency-sweeper.md](dependency-sweeper.md) | | Post-Merge Cleanup | 1d (Automation or manual) | Low | [post-merge-cleanup.md](post-merge-cleanup.md) | @@ -15,4 +16,4 @@ No `loop-init --tool cursor` yet — copy `SKILL.md` + `STATE.md` from any start Audit after copying: ```bash npx @cobusgreyling/loop-audit . --suggest -``` \ No newline at end of file +``` diff --git a/examples/cursor/ci-sweeper.md b/examples/cursor/ci-sweeper.md new file mode 100644 index 0000000..e9fe4f4 --- /dev/null +++ b/examples/cursor/ci-sweeper.md @@ -0,0 +1,99 @@ +# CI Sweeper — Cursor (Automations / Agent) + +This example maps the CI Sweeper loop to Cursor while keeping week one +report-only. Cursor [Automations](https://cursor.com/changelog/03-05-26) can run +on schedules or GitHub events in a managed cloud sandbox. Cursor does not expose +a repository-owned `/loop` or cron manifest, so use a GitHub Action or another +external scheduler when the cadence must live with the repository. + +## Setup + +Copy the shared skills and state into Cursor's project-local paths: + +```bash +mkdir -p .cursor/skills/ci-triage \ + .cursor/skills/minimal-fix \ + .cursor/skills/loop-verifier +cp starters/ci-sweeper/.claude/skills/ci-triage/SKILL.md \ + .cursor/skills/ci-triage/SKILL.md +cp templates/SKILL.md.minimal-fix \ + .cursor/skills/minimal-fix/SKILL.md +cp templates/SKILL.md.verifier \ + .cursor/skills/loop-verifier/SKILL.md +cp starters/ci-sweeper/ci-sweeper-state.md.example \ + ci-sweeper-state.md +``` + +Put always-on path denylists, attempt limits, and the no-auto-merge rule in +`.cursor/rules/` as well as in the Automation prompt. + +## Automation prompt (week one — report only) + +Create a scheduled or GitHub-triggered Automation with a prompt like: + +```text +Run the ci-triage skill against the latest failing checks on the default branch. +Read ci-sweeper-state.md before classifying each failure. +Record the check URL, failing job or test, first failing commit, confidence, +and whether the failure is a regression, flake, infrastructure issue, or unknown. +Update ci-sweeper-state.md with the evidence and proposed next action. + +Week one is report-only: +- do not edit source files or workflow files; +- do not create a worktree, branch, commit, pull request, or CI retry; +- do not post comments or change check status; +- do not merge or enable auto-merge. + +Escalate security, release, permissions, secrets, and infrastructure failures. +Stop after reporting when the root cause is ambiguous. +``` + +Review the state file after every run. A prompt is not a permission boundary: +keep write-capable MCP tools disabled and use GitHub branch protection and +least-privilege repository access. Cursor Automations can +[open PRs by default](https://cursor.com/changelog/06-18-26), so explicitly +disable that capability for the report-only phase. + +## L2 fix attempts (only after tuning) + +After the report-only output is consistently accurate, allow one narrowly +scoped fix only for a confirmed repository regression: + +1. A human approves the failing check, allowed paths, and validation command. +2. Create an isolated attempt with + `npx @cobusgreyling/loop-worktree create --run-id --pattern ci-sweeper`. +3. Run `minimal-fix` in that worktree; never edit the main checkout. +4. Run `loop-verifier` in a separate Agent session over the diff and test output. +5. On rejection, mark and discard the attempt. On approval, present the diff to + a human for the final decision. + +Never enable auto-merge. Stop after three attempts on one root cause and +escalate with the collected evidence. + +## Example `ci-sweeper-state.md` + +```markdown +# CI Sweeper State +Last run: 2026-07-23 06:00 UTC +Mode: report-only + +## Failing checks + +### validate / unit-tests +- URL: https://github.com/example/project/actions/runs/123 +- First failing commit: abc1234 +- Classification: likely regression (medium confidence) +- Evidence: test `parses empty input` fails consistently on two runs +- Proposed action: human review before an isolated fix attempt +- Attempts: 0 / 3 + +## Escalated +- deploy-production: permissions failure; no automated retry or fix +``` + +## References + +- [CI Sweeper pattern](../../patterns/ci-sweeper.md) +- [CI Sweeper starter](../../starters/ci-sweeper/) +- [`loop-worktree`](../../tools/loop-worktree/) +- [Safety and human gates](../../docs/safety.md) From 0d6ea0f8b316b9f52d915b64d5474ff70fa059d4 Mon Sep 17 00:00:00 2001 From: shixi-li Date: Thu, 23 Jul 2026 16:07:32 +0800 Subject: [PATCH 2/2] docs: clarify Cursor loop and permission boundaries --- examples/cursor/ci-sweeper.md | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/examples/cursor/ci-sweeper.md b/examples/cursor/ci-sweeper.md index e9fe4f4..0bb3432 100644 --- a/examples/cursor/ci-sweeper.md +++ b/examples/cursor/ci-sweeper.md @@ -2,9 +2,11 @@ This example maps the CI Sweeper loop to Cursor while keeping week one report-only. Cursor [Automations](https://cursor.com/changelog/03-05-26) can run -on schedules or GitHub events in a managed cloud sandbox. Cursor does not expose -a repository-owned `/loop` or cron manifest, so use a GitHub Action or another -external scheduler when the cadence must live with the repository. +on schedules or GitHub events in a managed cloud sandbox. Cursor also has a +local [`/loop` skill](https://cursor.com/changelog/shared-canvases) for +long-running agents, but it does not create a repository-owned, reviewable +schedule manifest. Use a GitHub Action or another external scheduler when the +cadence must live with the repository. ## Setup @@ -48,11 +50,13 @@ Escalate security, release, permissions, secrets, and infrastructure failures. Stop after reporting when the root cause is ambiguous. ``` -Review the state file after every run. A prompt is not a permission boundary: -keep write-capable MCP tools disabled and use GitHub branch protection and -least-privilege repository access. Cursor Automations can -[open PRs by default](https://cursor.com/changelog/06-18-26), so explicitly -disable that capability for the report-only phase. +Review the state file after every run. A prompt and `.cursor/rules` are not +permission boundaries: remove write-capable MCP and PR-opening tools where the +configuration allows, then use GitHub branch protection and least-privilege +repository access as backstops. Cursor Automations can +[open PRs by default](https://cursor.com/changelog/06-18-26). If that capability +cannot be removed, do not grant credentials that can push branches or open or +merge PRs; export the state change as an artifact for a human to apply instead. ## L2 fix attempts (only after tuning)