Maintain: close the loop

The maintain stage converts a bounded production signal into evidence, triage, and the next intent.md without waiting for a person to start a session. Deterministic detection invokes an agent with read-only or narrowly scoped access; a service owner still decides severity, ownership, remediation, and release authority.

Stages 1–5 still need a human to launch the first step. Maintain is where the loop runs headless. An independent confidence gate between stages — a deterministic check or an adversarial reviewing agent — decides whether the previous stage’s output continues or is escalated to a human.

Traditional: Maintenance is reactive. Tickets wait on a person. An alert at 3 a.m. can be missed. Post-mortem actions may never reach the codebase.

AI-native: A trigger (control-band breach, ticket, channel message, or schedule) invokes the agent without a person in the path. The agent diagnoses, acts only through gated routes, and writes what it finds as intent.md. People triage and review that work; they no longer have to start it.

Before you begin

• The intent.md format from Plan
• Agent PR review and hooks as an action boundary from Deploy
• A rehearsed rollback path

Infrastructure: a metrics store the detection script can query; read access to the repository; a way to run the agent non-interactively (CI, Cloud Agents, Codex automations, or the Claude Agent SDK).

Close the loop from a control band

Detection stays deterministic. The model is invoked only after a band is breached. The tier sets what it may do.

1. Pick one metric with a stable rolling baseline: CI test failure rate, post-deploy 5xx rate, or PR cycle time.

2. Write a detection script (mean and standard deviation over a rolling window, Western Electric or similar rules). Version-control and unit-test the script. No model is involved in detection.

3. Define response tiers in version-controlled config.

   At 1σ the script only logs. At 2σ it invokes the agent read-only to diagnose. At 3σ the agent may act, but only by opening a PR into the review gate or triggering a pre-approved runbook.

4. Choose a trigger layer: a scheduled GitHub or GitLab workflow, a webhook from the monitoring stack, or a cron job inside the network.

   The agent runs stateless. Because the run is non-interactive, a loop can begin and end without anyone starting it.

5. The agent writes its diagnosis as intent.md in the Plan format: the anomaly and its evidence, a proposed outcome, affected systems, open questions. From there the finding goes through the pipeline like anything else.

6. The service owner or on-call triages the queue: fix now, schedule, or dismiss. Dismissals tune the bands.

7. When a fix ships, add an eval for the incident (see Test).

Example bands.yaml:

metric: ci_test_failure_rate
baseline: rolling_30d
rules: western_electric
tiers:
  1sigma: { action: log }
  2sigma: { action: diagnose,
            tools: "Read,Grep,Bash(gh run view *)" }
  3sigma: { action: propose,
            routes: [pull_request, runbook:rollback-deploy] }

Examples of the pattern:

• CI test failure rate breaches 3σ → the agent quarantines the flaky test or opens a revert PR; the review gate decides.
• Post-deploy 5xx rate breaches 3σ with a deployment in the window → the agent triggers the existing rollback pipeline.
• PR cycle time trips a drift rule → the agent writes a report for engineering leadership.

Recurring codebase scans

A security scan is a point-in-time statement about a codebase under a particular model, and both halves go stale. Run the scan on a schedule, with no human in the invocation path, and send findings through the same gates as any other change.

1. Connect the repositories and group them so ownership of findings is clear.

2. Run a first full scan of the most critical repositories as the baseline. The first scan will likely surface findings in code that was considered clean.

3. Set a schedule per project. Weekly is a sensible default for actively developed services.

4. Triage with the confidence rating in hand. Dismiss with a reason so the same finding does not return as new.

5. For a bounded finding, open the suggested patch, review it, and send it through the PR review gate. The agent that proposed the fix has no route to approve it.

6. For anything wider than one patch, write it up as intent.md and start at Plan.

7. When a fix reaches production, add an eval for that vulnerability class.

8. Export findings to the tracker auditors already expect.

A vendor security agent or scheduled repository task can implement this pattern, but it complements rather than replaces deterministic SAST, dependency scanning, secret detection, and policy checks in CI. Every model-driven finding still needs reproducible evidence, a confidence label, an owner, and the normal review gate.

On-call in the channel

Incidents also arrive through team chat and issue trackers. Use a supported Claude, Cursor, or Codex integration only when its identity, scopes, retained data, and audit trail meet the organization’s requirements. A small, bounded fix may become a PR through the normal review gate; larger work becomes intent.md for triage.

The channel is the audit trail: request, diagnosis, human authorization, and fix stay where the incident was handled. See how Claude Tag runs on-call for CI/CD at Anthropic.

Governance

Tier boundaries are enforced from version-controlled config. Permissions and managed settings deny production access. Invocations, findings, and triage decisions are logged with a timestamp. A service owner triages and approves findings. Resulting changes go through the normal PR review gate. Runbooks the agent may trigger were approved in advance.

Verify

• A synthetic 3σ breach produces an intent.md in the triage queue without a human starting a session.
• A 3σ action can only open a PR or a pre-approved runbook — never a direct production mutate.
• Dismissals are recorded with a reason.

Leading indicator: time from band breach to an intent.md in the triage queue.

Lagging indicator: share of findings that become merged fixes; repeat incidents of the same class (should fall as evals accumulate).

Apply the play in your tool

Claude Code adapter Invoke a bounded claude -p triage task from a scheduler, routine, or incident workflow.

Cursor adapter Use Cloud Agents and Automations for scheduled or event-driven maintenance.

Codex adapter Use scheduled app tasks, hooks, CI schedules, Slack, or Linear intake.

The loop keeps running. Human judgment stays above it.