tools(agent-loop): two-agent loop scripts, hooks, prompts, nightly lessons

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tools/agent-loop/hooks/claude/pre-push

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Agent loop guard (Claude side). Installed per process through
+# GIT_CONFIG_KEY_0=core.hooksPath, never into the shared .git/hooks.
+# Refuses: any push to main, any branch deletion, and — when
+# AGENT_LOOP_DOCS_ONLY=1 (nightly review) — a staging push that touches a gated path.
+zero=0000000000000000000000000000000000000000
+status=0
+while read -r local_ref local_sha remote_ref remote_sha; do
+  case "$remote_ref" in
+    refs/heads/main|refs/heads/master)
+      echo "agent-loop pre-push: pushing to $remote_ref is reserved for the product owner" >&2
+      status=1 ;;
+  esac
+  if [ "$local_sha" = "$zero" ]; then
+    echo "agent-loop pre-push: deleting $remote_ref is not allowed" >&2
+    status=1
+  fi
+  if [ "${AGENT_LOOP_DOCS_ONLY:-0}" = "1" ] && [ "$remote_ref" = "refs/heads/staging" ]; then
+    if ! deploy/is-docs-only-range.sh --git "$remote_sha" "$local_sha" >/dev/null 2>&1; then
+      echo "agent-loop pre-push: nightly review may only push docs-only changes to staging" >&2
+      status=1
+    fi
+  fi
+done
+exit $status

tools/agent-loop/hooks/grok/pre-push

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Agent loop guard (Grok side, Windows; runs under Git for Windows' sh).
+# Installed per process through GIT_CONFIG_KEY_0=core.hooksPath.
+# Grok may only create or update branches named codex/*; never delete.
+zero=0000000000000000000000000000000000000000
+status=0
+while read -r local_ref local_sha remote_ref remote_sha; do
+  case "$remote_ref" in
+    refs/heads/codex/*) ;;
+    *)
+      echo "agent-loop pre-push: Grok may only push refs/heads/codex/*, refused $remote_ref" >&2
+      status=1 ;;
+  esac
+  if [ "$local_sha" = "$zero" ]; then
+    echo "agent-loop pre-push: deleting $remote_ref is not allowed" >&2
+    status=1
+  fi
+done
+exit $status