docs(cli): fix loop init flag example

`micro loop init` writes an autonomous improvement loop into any repository —
the same planner/builder/triage loop that maintains go-micro, generalized:

- planner (loop-planner.yml): keeps a ranked queue in .github/loop/PRIORITIES.md
- builder (loop-builder.yml): builds the top open item as a single-concern PR,
  auto-merged on green CI
- triage (loop-triage.yml): turns CI failures into scoped fix issues

plus .github/loop/NORTH_STAR.md (direction) and PRIORITIES.md (queue).

The agent adapter is mention-based, not hardcoded to Codex: `--agent @codex`
(or any @mention agent that responds on an issue and can run gh), `--token-secret`,
`--branch`, `--ci-workflow`, and cron flags are the whole config-vs-core boundary.
Templates use << >> delimiters so GitHub Actions' own ${{ }} expressions pass
through untouched. `micro loop verify` checks the wiring and flags the two things
the CLI can't: the token secret and branch protection (the green-CI gate).

Built inside go-micro with the config/core split already drawn, so the workflows
can later be extracted to a standalone reusable-workflows repo without a rewrite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL

CHANGELOG.md

@@ -16,6 +16,9 @@ next version when it ships.
 
 ## [Unreleased]
 
+### Added
+- **`micro loop`** — scaffold an autonomous improvement loop into any repository: GitHub Actions workflows for a planner (keeps a ranked queue), builder (builds the top item as a single-concern PR, auto-merged on green CI), and triage (turns CI failures into fix issues), dispatched to an @mention-driven coding agent. `micro loop init` writes the workflows + `NORTH_STAR`/`PRIORITIES`; `micro loop verify` checks the wiring. This is the loop that maintains go-micro itself, generalized. (`cmd/micro/loop/`)
+
 ---
 
 ## [6.3.12] - July 2026

cmd/micro/README.md

@@ -625,3 +625,49 @@ Scopes provide fine-grained access control over which tokens can call which serv
 The gateway's scope system uses `auth.Account` from the go-micro framework. Scopes on accounts are the same `[]string` field used by the framework's `auth.Rules` and `wrapper/auth` package. The gateway stores scope requirements in the default store under `endpoint-scopes/<service>.<endpoint>` keys and checks them on every HTTP request.
 
 For service-level (RPC) auth within the go-micro mesh, use the `wrapper/auth` package which provides `auth.Rules` with priority-based access control. See the [auth wrapper documentation](../../wrapper/auth/README.md) for details.
+
+## Self-improving loop (`micro loop`)
+
+Turn a repository into a self-improving one: GitHub Actions workflows that
+dispatch a coding agent to plan, build, and triage — gated by CI. This is the
+same loop that maintains go-micro itself, generalized so any repo (and any
+@mention-driven agent) can use it.
+
+```bash
+micro loop init      # scaffold the loop into the current repo
+micro loop verify    # check a repo is wired correctly
+```
+
+`micro loop init` writes three workflows and a queue:
+
+| Role | File | What it does |
+|------|------|--------------|
+| Planner | `.github/workflows/loop-planner.yml` | Keeps a ranked queue in `.github/loop/PRIORITIES.md` |
+| Builder | `.github/workflows/loop-builder.yml` | Builds the top open item as a single-concern PR, auto-merged on green CI |
+| Triage | `.github/workflows/loop-triage.yml` | Turns CI failures into scoped fix issues, back into the queue |
+
+Direction lives in `.github/loop/NORTH_STAR.md` — edit it to steer the loop.
+
+Common flags:
+
+```bash
+micro loop init \
+  --agent @codex \
+  --token-secret LOOP_TOKEN \
+  --branch main \
+  --ci-workflow CI
+```
+
+- `--agent`: how the workflows summon the agent (an `@mention`)
+- `--token-secret`: repo secret holding the driving user PAT
+- `--branch`: base branch for the loop's PRs
+- `--ci-workflow`: `name:` of the CI workflow triage watches
+
+Two things the CLI can't do for you (and `micro loop verify` reminds you of):
+
+1. **Add the token secret.** The agent ignores `@mentions` from the
+   `github-actions` bot, so dispatch posts as a real user via a PAT stored in
+   the `--token-secret` repo secret. The workflows no-op until it's set.
+2. **Set branch protection.** Require the CI checks with **0 approving reviews**
+   so the builder's native auto-merge lands PRs the moment CI is green — that
+   green-CI gate is the loop's only safety mechanism, so keep the suite strong.

cmd/micro/loop/loop.go

@@ -0,0 +1,300 @@
+// Package loop implements the 'micro loop' command, which scaffolds and
+// verifies an autonomous improvement loop for a repository.
+//
+// The loop is a set of GitHub Actions workflows — a planner that keeps a ranked
+// queue, a builder that builds the top item as a single-concern PR, and a triage
+// pass that turns CI failures into fix issues — that dispatch a coding agent by
+// @mention on a fresh tracking issue each run. `micro loop init` writes those
+// workflows (plus a NORTH_STAR and PRIORITIES queue) into a repo; `micro loop
+// verify` checks that a repo is wired correctly.
+package loop
+
+import (
+	"bytes"
+	"embed"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/urfave/cli/v2"
+	"go-micro.dev/v6/cmd"
+)
+
+//go:embed templates/*
+var templatesFS embed.FS
+
+// config is the substitution surface for the workflow templates. It is the
+// whole "config vs core" boundary: the workflows are the reusable core, these
+// fields are what a given repo tunes.
+type config struct {
+	DefaultBranch string // base branch for the loop's PRs (e.g. main)
+	AgentMention  string // how the workflows summon the agent (e.g. @codex)
+	TokenSecret   string // repo secret holding the user PAT that drives dispatch
+	CIWorkflow    string // name: of the CI workflow triage watches for failures
+	PlannerCron   string // cron for the planner
+	BuilderCron   string // cron for the builder
+}
+
+// generated workflow files: template name -> destination (relative to repo root).
+var workflows = map[string]string{
+	"templates/loop-planner.yml.tmpl": ".github/workflows/loop-planner.yml",
+	"templates/loop-builder.yml.tmpl": ".github/workflows/loop-builder.yml",
+	"templates/loop-triage.yml.tmpl":  ".github/workflows/loop-triage.yml",
+}
+
+// static (non-templated) docs: template name -> destination.
+var docs = map[string]string{
+	"templates/NORTH_STAR.md": ".github/loop/NORTH_STAR.md",
+	"templates/PRIORITIES.md": ".github/loop/PRIORITIES.md",
+}
+
+func init() {
+	cmd.Register(&cli.Command{
+		Name:  "loop",
+		Usage: "Scaffold an autonomous improvement loop for a repository",
+		Description: `Set up a self-improving loop for a repo: GitHub Actions workflows that
+dispatch a coding agent to plan, build, and triage — gated by CI.
+
+The loop has three roles:
+  planner  keeps a ranked queue in .github/loop/PRIORITIES.md
+  builder  builds the top open item as a single-concern PR (auto-merged on green CI)
+  triage   turns CI failures into scoped fix issues back into the queue
+
+Direction lives in .github/loop/NORTH_STAR.md — edit it to steer the loop.
+
+Examples:
+  # Scaffold the loop into the current repo
+  micro loop init
+
+  # Customize the agent, token secret, base branch, and CI workflow name
+  micro loop init --agent @codex --token-secret LOOP_TOKEN \
+    --branch main --ci-workflow CI
+
+  # Check that a repo is wired correctly
+  micro loop verify`,
+		Subcommands: []*cli.Command{
+			{
+				Name:  "init",
+				Usage: "Scaffold the loop workflows and queue into a repo",
+				Flags: []cli.Flag{
+					&cli.StringFlag{Name: "dir", Usage: "Target repo directory", Value: "."},
+					&cli.StringFlag{Name: "branch", Usage: "Base branch for the loop's PRs (auto-detected if empty)"},
+					&cli.StringFlag{Name: "agent", Usage: "How the workflows summon the agent (an @mention)", Value: "@codex"},
+					&cli.StringFlag{Name: "token-secret", Usage: "Repo secret holding the user PAT that drives dispatch", Value: "LOOP_TOKEN"},
+					&cli.StringFlag{Name: "ci-workflow", Usage: "name: of the CI workflow triage watches for failures", Value: "CI"},
+					&cli.StringFlag{Name: "planner-cron", Usage: "Cron schedule for the planner", Value: "0 * * * *"},
+					&cli.StringFlag{Name: "builder-cron", Usage: "Cron schedule for the builder", Value: "30 * * * *"},
+					&cli.BoolFlag{Name: "force", Usage: "Overwrite existing loop files"},
+				},
+				Action: runInit,
+			},
+			{
+				Name:   "verify",
+				Usage:  "Verify a repo is wired for the loop",
+				Flags:  []cli.Flag{&cli.StringFlag{Name: "dir", Usage: "Target repo directory", Value: "."}},
+				Action: runVerify,
+			},
+		},
+	})
+}
+
+func runInit(c *cli.Context) error {
+	dir := c.String("dir")
+	cfg := config{
+		DefaultBranch: c.String("branch"),
+		AgentMention:  strings.TrimSpace(c.String("agent")),
+		TokenSecret:   strings.TrimSpace(c.String("token-secret")),
+		CIWorkflow:    c.String("ci-workflow"),
+		PlannerCron:   c.String("planner-cron"),
+		BuilderCron:   c.String("builder-cron"),
+	}
+	if cfg.DefaultBranch == "" {
+		cfg.DefaultBranch = detectDefaultBranch(dir)
+	}
+	if !strings.HasPrefix(cfg.AgentMention, "@") {
+		cfg.AgentMention = "@" + cfg.AgentMention
+	}
+
+	if err := scaffold(dir, cfg, c.Bool("force")); err != nil {
+		return err
+	}
+	printNextSteps(cfg)
+	return nil
+}
+
+// scaffold renders the workflow templates and writes the loop files into dir.
+// Static docs (NORTH_STAR, PRIORITIES) are never clobbered even with force, so
+// re-running init can't wipe curated direction or a hand-tuned queue.
+func scaffold(dir string, cfg config, force bool) error {
+	for tmplName, dest := range workflows {
+		rendered, err := render(tmplName, cfg)
+		if err != nil {
+			return err
+		}
+		if err := writeFile(filepath.Join(dir, dest), rendered, force); err != nil {
+			return err
+		}
+		fmt.Printf("  wrote %s\n", dest)
+	}
+
+	for tmplName, dest := range docs {
+		full := filepath.Join(dir, dest)
+		if fileExists(full) {
+			fmt.Printf("  kept  %s (already exists)\n", dest)
+			continue
+		}
+		b, err := templatesFS.ReadFile(tmplName)
+		if err != nil {
+			return err
+		}
+		if err := writeFile(full, b, true); err != nil {
+			return err
+		}
+		fmt.Printf("  wrote %s\n", dest)
+	}
+	return nil
+}
+
+// verifyState reports what's wrong with dir's loop setup: warnings are
+// non-fatal, missing are required files that aren't present.
+func verifyState(dir string) (warnings, missing []string) {
+	for _, dest := range workflows {
+		if !fileExists(filepath.Join(dir, dest)) {
+			missing = append(missing, dest)
+		}
+	}
+	for _, dest := range docs {
+		if !fileExists(filepath.Join(dir, dest)) {
+			missing = append(missing, dest)
+		}
+	}
+	// The loop is only as good as its gate: warn if there's no non-loop
+	// workflow to serve as CI.
+	if !hasCIWorkflow(dir) {
+		warnings = append(warnings, "no non-loop workflow found in .github/workflows — the loop needs a CI gate (build/test/lint) to merge safely")
+	}
+	return warnings, missing
+}
+
+func runVerify(c *cli.Context) error {
+	dir := c.String("dir")
+	warnings, missing := verifyState(dir)
+
+	for _, m := range missing {
+		fmt.Printf("  MISSING  %s\n", m)
+	}
+	for _, w := range warnings {
+		fmt.Printf("  WARN     %s\n", w)
+	}
+
+	if len(missing) > 0 {
+		return fmt.Errorf("loop is not fully scaffolded (%d file(s) missing) — run `micro loop init`", len(missing))
+	}
+
+	fmt.Println("  OK       loop workflows and queue are present")
+	fmt.Println()
+	fmt.Println("Reminders the CLI can't check:")
+	fmt.Println("  • The token secret must be set in the repo (Settings → Secrets).")
+	fmt.Println("  • Branch protection must require the CI checks with 0 approvals,")
+	fmt.Println("    so the builder's auto-merge can land PRs on green CI.")
+	if len(warnings) > 0 {
+		return fmt.Errorf("%d warning(s) — see above", len(warnings))
+	}
+	return nil
+}
+
+func render(tmplName string, cfg config) ([]byte, error) {
+	b, err := templatesFS.ReadFile(tmplName)
+	if err != nil {
+		return nil, err
+	}
+	// Custom delimiters so GitHub Actions' own ${{ }} expressions pass through
+	// untouched — only << >> placeholders are substituted.
+	t, err := template.New(filepath.Base(tmplName)).Delims("<<", ">>").Option("missingkey=error").Parse(string(b))
+	if err != nil {
+		return nil, fmt.Errorf("parse %s: %w", tmplName, err)
+	}
+	var buf bytes.Buffer
+	if err := t.Execute(&buf, cfg); err != nil {
+		return nil, fmt.Errorf("render %s: %w", tmplName, err)
+	}
+	return buf.Bytes(), nil
+}
+
+func writeFile(path string, content []byte, force bool) error {
+	if fileExists(path) && !force {
+		return fmt.Errorf("%s already exists (use --force to overwrite)", path)
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(path, content, 0o644)
+}
+
+func fileExists(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && !info.IsDir()
+}
+
+// hasCIWorkflow reports whether .github/workflows holds any workflow that is
+// not one of the loop's own (i.e. a plausible CI gate).
+func hasCIWorkflow(dir string) bool {
+	entries, err := os.ReadDir(filepath.Join(dir, ".github", "workflows"))
+	if err != nil {
+		return false
+	}
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		name := e.Name()
+		if strings.HasPrefix(name, "loop-") {
+			continue
+		}
+		if strings.HasSuffix(name, ".yml") || strings.HasSuffix(name, ".yaml") {
+			return true
+		}
+	}
+	return false
+}
+
+// detectDefaultBranch best-effort resolves the repo's default branch, falling
+// back to "main".
+func detectDefaultBranch(dir string) string {
+	out, err := exec.Command("git", "-C", dir, "symbolic-ref", "--short", "refs/remotes/origin/HEAD").Output()
+	if err == nil {
+		ref := strings.TrimSpace(string(out))
+		if i := strings.LastIndex(ref, "/"); i >= 0 {
+			ref = ref[i+1:]
+		}
+		if ref != "" {
+			return ref
+		}
+	}
+	return "main"
+}
+
+func printNextSteps(cfg config) {
+	fmt.Printf(`
+Loop scaffolded. Next steps (the CLI can't do these for you):
+
+  1. Edit .github/loop/NORTH_STAR.md — the direction the loop aligns to.
+     Seed .github/loop/PRIORITIES.md with a few real items.
+
+  2. Add a repo secret named %s: a fine-grained user PAT (contents + pull
+     requests + issues write) for an account the agent (%s) responds to.
+     The workflows no-op until this secret exists.
+
+  3. Ensure a CI workflow named %q exists and that branch protection on %q
+     requires its checks with 0 approving reviews — that green-CI gate is
+     what lets the builder auto-merge safely.
+
+  4. Commit these files, then trigger a run:
+     Actions → "Loop: Planner" / "Loop: Builder" → Run workflow.
+
+Verify anytime with: micro loop verify
+`, cfg.TokenSecret, cfg.AgentMention, cfg.CIWorkflow, cfg.DefaultBranch)
+}

cmd/micro/loop/loop_test.go

@@ -0,0 +1,107 @@
+package loop
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRenderProducesValidPlaceholderFreeYAML(t *testing.T) {
+	cfg := config{
+		DefaultBranch: "main",
+		AgentMention:  "@codex",
+		TokenSecret:   "LOOP_TOKEN",
+		CIWorkflow:    "CI",
+		PlannerCron:   "0 * * * *",
+		BuilderCron:   "30 * * * *",
+	}
+
+	for tmplName := range workflows {
+		rendered, err := render(tmplName, cfg)
+		if err != nil {
+			t.Fatalf("render %s: %v", tmplName, err)
+		}
+		s := string(rendered)
+
+		// No unresolved substitution delimiters should remain...
+		if strings.Contains(s, "<<") || strings.Contains(s, ">>") {
+			t.Errorf("%s still contains << >> placeholders after render", tmplName)
+		}
+		// ...but GitHub Actions' own ${{ }} expressions must survive verbatim.
+		if !strings.Contains(s, "${{ secrets.LOOP_TOKEN") {
+			t.Errorf("%s lost its ${{ secrets.LOOP_TOKEN }} expression", tmplName)
+		}
+		// The configured values must be substituted in.
+		if !strings.Contains(s, "@codex") {
+			t.Errorf("%s missing agent mention", tmplName)
+		}
+		// Structural sanity: a workflow needs these top-level keys.
+		for _, key := range []string{"name:", "on:", "jobs:"} {
+			if !strings.Contains(s, key) {
+				t.Errorf("%s missing top-level %q", tmplName, key)
+			}
+		}
+	}
+}
+
+func TestInitThenVerify(t *testing.T) {
+	dir := t.TempDir()
+	// A non-loop workflow so verify's CI-gate check passes.
+	mustWrite(t, filepath.Join(dir, ".github/workflows/ci.yml"), "name: CI\n")
+
+	if err := scaffold(dir, config{
+		DefaultBranch: "main",
+		AgentMention:  "@codex",
+		TokenSecret:   "LOOP_TOKEN",
+		CIWorkflow:    "CI",
+		PlannerCron:   "0 * * * *",
+		BuilderCron:   "30 * * * *",
+	}, false); err != nil {
+		t.Fatalf("scaffold: %v", err)
+	}
+
+	for _, dest := range workflows {
+		if !fileExists(filepath.Join(dir, dest)) {
+			t.Errorf("expected %s to be written", dest)
+		}
+	}
+	for _, dest := range docs {
+		if !fileExists(filepath.Join(dir, dest)) {
+			t.Errorf("expected %s to be written", dest)
+		}
+	}
+
+	// A second scaffold without --force must fail on an existing workflow.
+	if err := scaffold(dir, config{DefaultBranch: "main", AgentMention: "@codex", TokenSecret: "LOOP_TOKEN", CIWorkflow: "CI", PlannerCron: "0 * * * *", BuilderCron: "30 * * * *"}, false); err == nil {
+		t.Error("expected second scaffold without --force to fail")
+	}
+}
+
+func TestVerifyMissingFilesFails(t *testing.T) {
+	dir := t.TempDir()
+	if _, missing := verifyState(dir); len(missing) == 0 {
+		t.Error("expected missing files in an empty dir")
+	}
+}
+
+func TestVerifyWarnsWithoutCIGate(t *testing.T) {
+	dir := t.TempDir()
+	if err := scaffold(dir, config{DefaultBranch: "main", AgentMention: "@codex", TokenSecret: "LOOP_TOKEN", CIWorkflow: "CI", PlannerCron: "0 * * * *", BuilderCron: "30 * * * *"}, false); err != nil {
+		t.Fatalf("scaffold: %v", err)
+	}
+	// Only loop-* workflows exist → no CI gate.
+	if hasCIWorkflow(dir) {
+		t.Error("expected no CI gate when only loop-* workflows are present")
+	}
+}
+
+func mustWrite(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}

cmd/micro/loop/templates/NORTH_STAR.md

@@ -0,0 +1,23 @@
+# North Star
+
+> **Edit this file.** It is the single source of direction the loop aligns every
+> increment to. The planner ranks work against it; the builder builds toward it.
+> Be concrete — vague direction produces vague increments.
+
+## Mission
+
+<One or two sentences: the problem this repository solves and who it's for.>
+
+## Right now
+
+<The current priority — what "better" means this month. The planner weights the
+queue toward this.>
+
+## Guardrails
+
+- One concern per PR; small and reversible.
+- The gate is green CI, not a human review — keep the test/lint suite strong,
+  because the loop is only as good as its evaluator.
+- **Off-limits without a human** (surface as notes, never auto-merge): breaking
+  public API changes, brand/positioning/marketing copy, new dependencies,
+  architectural rewrites, product-default changes with broad behavioral impact.

cmd/micro/loop/templates/PRIORITIES.md

@@ -0,0 +1,16 @@
+# Priorities
+
+A single ranked queue, highest-value first. Each item links a scoped issue the
+loop can build and CI can verify. The **planner** keeps this current; the
+**builder** takes the top item whose issue is still open.
+
+<!--
+Seed this with a few real items to give the loop a running start, e.g.:
+
+1. Add retry with backoff to the HTTP client — #123
+2. Document the config file format — #124
+3. Fix flaky timeout in the cache tests — #125
+
+The planner will re-rank, drop completed items, and file issues for new gaps.
+Reorder or edit this file at any time to redirect the loop.
+-->

cmd/micro/loop/templates/loop-builder.yml.tmpl

@@ -0,0 +1,46 @@
+name: "Loop: Builder"
+
+# Generated by `micro loop init`. The GENERATOR of the loop: each run it opens a
+# fresh tracking issue and dispatches the agent to build the top open item from
+# .github/loop/PRIORITIES.md as a single-concern PR, then enables native
+# auto-merge so the PR lands once the required CI checks pass. Branch protection
+# (required checks, 0 approvals) is the gate — there is no merge sweep.
+#
+# A FRESH issue per run is deliberate: agents derive the PR branch name from the
+# triggering issue, so reusing one tracker collapses every run onto one branch
+# and only the first PR opens. Gated on << .TokenSecret >> (see loop-planner.yml).
+
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: "<< .BuilderCron >>"
+
+permissions:
+  issues: write
+
+concurrency:
+  group: loop-builder
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Open an increment issue and dispatch the agent
+        env:
+          GH_TOKEN: ${{ secrets.<< .TokenSecret >> || github.token }}
+          HAS_TOKEN: ${{ secrets.<< .TokenSecret >> != '' }}
+          REPO: ${{ github.repository }}
+          RUN_NUMBER: ${{ github.run_number }}
+        run: |
+          if [ "$HAS_TOKEN" != "true" ]; then
+            echo "<< .TokenSecret >> is not set — skipping (see loop-planner.yml)."
+            exit 0
+          fi
+          ISSUE_URL=$(gh issue create --repo "$REPO" \
+            --title "Loop: build increment #$RUN_NUMBER" \
+            --body "Autonomous build increment. Direction: .github/loop/NORTH_STAR.md. Queue: .github/loop/PRIORITIES.md.")
+          ISSUE_NUM="${ISSUE_URL##*/}"
+          echo "Opened issue #$ISSUE_NUM — dispatching the builder."
+          gh issue comment "$ISSUE_NUM" --repo "$REPO" --body \
+          "<< .AgentMention >> Build one increment for this repository, aligned to .github/loop/NORTH_STAR.md. PICK THE WORK: take the highest-ranked item in .github/loop/PRIORITIES.md whose linked issue is still OPEN — that is your task and its issue is the one you close. If the queue is empty or every item's issue is closed, pick the single highest-value improvement yourself. Implement it, then VERIFY the project builds, tests, and lints (use the commands documented in the README or the CI workflow). Open the PR YOURSELF from the shell — do NOT use a make_pr tool (it may be a no-op stub): \`git switch -c loop/increment-$ISSUE_NUM\`, \`git push -u origin loop/increment-$ISSUE_NUM\`, \`gh pr create --base << .DefaultBranch >> --title \"<title>\" --body \"<body; include 'Closes #<the item's issue>' so it leaves the queue, and 'Closes #$ISSUE_NUM' for this tracker>\"\`, then \`gh pr merge --squash --auto --delete-branch\` so it lands on green CI. One concern per PR; stay out of breaking public API and brand/positioning copy."

cmd/micro/loop/templates/loop-planner.yml.tmpl

@@ -0,0 +1,48 @@
+name: "Loop: Planner"
+
+# Generated by `micro loop init`. Part of an autonomous improvement loop:
+# a PLANNER (this file) keeps a ranked queue, a BUILDER builds the top item,
+# and CI + a TRIAGE pass are the evaluator. The loop dispatches a coding agent
+# by @mention on a fresh tracking issue each run.
+#
+# Gated on the << .TokenSecret >> secret: the agent ignores @mentions from the
+# github-actions bot, so the dispatch must post as a real user (a PAT). Until
+# that secret is set the workflow runs but no-ops. Direction lives in
+# .github/loop/NORTH_STAR.md; the ranked queue in .github/loop/PRIORITIES.md.
+
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: "<< .PlannerCron >>"
+
+permissions:
+  issues: write
+
+concurrency:
+  group: loop-planner
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Open a planning issue and dispatch the agent
+        env:
+          GH_TOKEN: ${{ secrets.<< .TokenSecret >> || github.token }}
+          HAS_TOKEN: ${{ secrets.<< .TokenSecret >> != '' }}
+          REPO: ${{ github.repository }}
+          RUN_NUMBER: ${{ github.run_number }}
+        run: |
+          if [ "$HAS_TOKEN" != "true" ]; then
+            echo "<< .TokenSecret >> is not set — skipping."
+            echo "The agent ignores @mentions from the github-actions bot, so a"
+            echo "user PAT is required. Add a << .TokenSecret >> secret to activate."
+            exit 0
+          fi
+          ISSUE_URL=$(gh issue create --repo "$REPO" \
+            --title "Loop: planning review #$RUN_NUMBER" \
+            --body "Autonomous planning pass. Direction: .github/loop/NORTH_STAR.md. Queue: .github/loop/PRIORITIES.md.")
+          ISSUE_NUM="${ISSUE_URL##*/}"
+          echo "Opened issue #$ISSUE_NUM — dispatching the planner."
+          gh issue comment "$ISSUE_NUM" --repo "$REPO" --body \
+          "<< .AgentMention >> Act as the planner for this repository. (1) Read .github/loop/NORTH_STAR.md for direction, then assess current state — recently merged PRs and open issues — so the queue reflects reality (drop done items, don't re-queue in-flight work). (2) Maintain a SINGLE ranked queue in .github/loop/PRIORITIES.md, highest-value first, each item linking a scoped, CI-verifiable issue (#N). For any prioritized gap with no issue, file one: \`gh issue create --title \"<scoped task>\" --body \"<goal, scope, acceptance criteria>\"\`. (3) If the ranking actually changed, open ONE PR for PRIORITIES.md: \`git switch -c loop/planner-$ISSUE_NUM\`, \`git push -u origin loop/planner-$ISSUE_NUM\`, \`gh pr create --base << .DefaultBranch >> --title \"<title>\" --body \"<summary, Closes #$ISSUE_NUM>\"\`, then \`gh pr merge --squash --auto --delete-branch\`. If the queue is already accurate, just close this issue (\`gh issue close $ISSUE_NUM\`). Do NOT make breaking or architectural changes yourself — surface those as notes for a human. Open the PR yourself from the shell with gh; do not use a make_pr tool."

cmd/micro/loop/templates/loop-triage.yml.tmpl

@@ -0,0 +1,46 @@
+name: "Loop: Triage"
+
+# Generated by `micro loop init`. The feedback path of the evaluator: when the
+# CI workflow ("<< .CIWorkflow >>") fails on a non-PR run, this dispatches the
+# agent to root-cause the failure and file scoped fix issues back into the
+# planner's queue — so failures become fixes with no human in the middle, short
+# of a decision that is genuinely a human's. Gated on << .TokenSecret >>.
+
+on:
+  workflow_run:
+    workflows: ["<< .CIWorkflow >>"]
+    types: [completed]
+
+permissions:
+  issues: write
+
+concurrency:
+  group: loop-triage
+  cancel-in-progress: false
+
+jobs:
+  triage:
+    # Only real failures on branch pushes/schedules — not PR-run failures, which
+    # the PR author already sees.
+    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'pull_request' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: File a triage issue and dispatch the agent
+        env:
+          GH_TOKEN: ${{ secrets.<< .TokenSecret >> || github.token }}
+          HAS_TOKEN: ${{ secrets.<< .TokenSecret >> != '' }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+        run: |
+          if [ "$HAS_TOKEN" != "true" ]; then
+            echo "<< .TokenSecret >> is not set — skipping (see loop-planner.yml)."
+            exit 0
+          fi
+          ISSUE_URL=$(gh issue create --repo "$REPO" \
+            --title "Loop: triage failed run $RUN_ID" \
+            --body "The '<< .CIWorkflow >>' workflow failed: $RUN_URL")
+          ISSUE_NUM="${ISSUE_URL##*/}"
+          echo "Opened issue #$ISSUE_NUM — dispatching triage."
+          gh issue comment "$ISSUE_NUM" --repo "$REPO" --body \
+          "<< .AgentMention >> Triage the failed CI run at $RUN_URL. Read the logs and root-cause each distinct failure. DEDUPE against open issues — if a failure matches an existing issue, comment 'recurred' there instead of filing a duplicate. For each genuine, self-contained defect, file a scoped issue (\`gh issue create --title \"<scoped fix>\" --body \"<root cause, where, acceptance>\"\`) so the planner/builder can pick it up and the next CI run verifies it. IGNORE transient flakes (network blips, provider outages, timeouts with no code cause). Anything needing a breaking or architectural change: label it needs-human and describe it — do NOT auto-file it as a routine fix. Close this issue (\`gh issue close $ISSUE_NUM\`) when triage is done."

cmd/micro/main.go

@@ -13,6 +13,7 @@ import (
 	_ "go-micro.dev/v6/cmd/micro/cli/deploy"
 	_ "go-micro.dev/v6/cmd/micro/flow"
 	_ "go-micro.dev/v6/cmd/micro/inspect"
+	_ "go-micro.dev/v6/cmd/micro/loop"
 	_ "go-micro.dev/v6/cmd/micro/mcp"
 	_ "go-micro.dev/v6/cmd/micro/resource"
 	_ "go-micro.dev/v6/cmd/micro/run"