| Pattern | Cadence | Status | Command |
|---|---|---|---|
| Dependency Sweeper | 6h | L2 assisted (patch-only) | See README |
- Major version bumps → human approval always
- High-severity CVE requiring breaking change → human
- Denylist packages (edit in state file) → never auto-touch
- No auto-merge without verifier pass + allowlist
- One worktree per package update attempt
- Discard worktree on REJECT or after human escalation
- Max sub-agent spawns per run: 3
- Max auto-PRs per day: 5
- Pause if token budget exceeded (see
templates/loop-budget.md.template)
- Pattern: dependency-sweeper
- Safety: safety.md