autoresearch
Autonomous iteration loop: modify, verify, keep/discard against any metric
Security Assessment
Detected risks:
About autoresearch
autoresearch is an autonomous, goal-directed iteration engine: it modifies, verifies, and keeps or discards changes against any metric until a goal is met. It solves the problem of running disciplined improvement loops — optimization, debugging, hardening, shipping — without a human driving every cycle, while keeping strict safety boundaries. Every invocation prints a mode banner and logs all results to a timestamped `autoresearch/{subcommand}-{YYMMDD}-{HHMM}/` directory, with chain handoff via `handoff.json`.
The skill dispatches into several modes. Providing a `Metric:` or `Verify:` runs the Classic metric loop (modify → verify → keep/discard); a free-form natural-language goal activates the Orchestrator, which classifies the goal into an archetype and either runs an orchestration loop until a mechanical success predicate is met or does a single-pass dispatch for subjective goals; and an empty invocation opens a setup wizard. It exposes a rich set of subcommands with sensible default iteration bounds — including `plan`, `debug`, `fix`, `security` (STRIDE + OWASP audit with red-team personas), `ship` (an eight-phase deploy pipeline), `scenario`, `predict`, `learn`, `reason`, `probe`, `improve`, `evals`, and `regression` — plus universal flags such as `Iterations: N`/`unlimited`, `--evals`, `--chain`, `--dry-run`, and `--max-cycles`. Strong safety invariants run throughout: it never pushes, publishes, or deploys without explicit user approval, never auto-approves ship/deploy, safety-screens every derived command, pins the success predicate so 'done' is reproducible, keeps data-migration behind an anchored DB-URL allowlist, and requires an independent verify hop before declaring convergence.
The skill targets engineers who want an automated but bounded and auditable loop for improving code against a concrete objective — optimizing a metric, crushing errors, hardening security, or preparing a release — with the agent orchestrating multiple specialized subcommands and stopping on convergence, plateau, ceiling, or a blocked state.
FAQ
How does autoresearch decide which mode to run?
If the invocation includes `Metric:` or `Verify:`, it runs the Classic metric loop. A free-form goal with no metric activates the Orchestrator, an empty invocation opens the setup wizard, and `--classic` or `--auto` force a mode explicitly.
What are its core safety guarantees?
It never pushes, publishes, or deploys without explicit user approval, never auto-approves ship/deploy, safety-screens every derived command (including on resume), pins the success predicate for reproducibility, restricts data migration to an anchored DB-URL allowlist, and requires an independent verify hop before convergence.
Is the loop bounded?
Yes, it is bounded by default with per-subcommand iteration defaults (for example 25 for the metric loop, 15 for debug, 20 for fix). You can override with `Iterations: N` or opt into `Iterations: unlimited`, and the orchestrator has a cycle ceiling via `--max-cycles`.
Where do results go?
All results are logged to a timestamped `autoresearch/{subcommand}-{YYMMDD}-{HHMM}/` directory, chained between steps via `handoff.json`, with `evals` reading `*-results.tsv`.
What stop conditions end an orchestration run?
The run stops when the success predicate is met (CONVERGED, or a ship gate if ship is in the pipeline), on PLATEAU, when the cycle ceiling is exceeded (CEILING), or when a hop is blocked or failed with no alternative route (BLOCKED).
All Files
20 filesInstall autoresearch
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
uditgoenka/autoresearch