loopx-pr-merge

loopx-pr-merge is a skill for Codex from huangruiteng/loopx. It costs 65 tokens per session (1,370 once invoked), scanned A, original, Apache-2.0.

A maintainer workflow for deciding whether a LoopX pull request may be approved or merged. A pull request is a proposed code change, and the workflow requires review evidence for the exact version being merged.

In plain words
What is it for?
Use it to check review evidence, apply the completion rules, recheck the remote head, and decide whether to approve, merge, self-merge, or use an authorised bypass.
Why use it?
It prevents a merge decision based only on a diff, green CI, or pull-request metadata when the reviewed code may have changed. It records the authority and validation behind the decision.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: mentions AGENTS.md.

Good fit Use it to check review evidence, apply the completion rules, recheck the remote head, and decide whether to approve, merge, self-merge, or use an authorised bypass.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/huangruiteng/loopx/loopx-pr-merge
About the project

LoopX is a provider-neutral control plane that gives long-running AI-agent work persistent state, decisions, governance, recovery, and handoffs across different agent harnesses. It is for managing and reviewing durable work performed by Codex, Claude Code, Cursor, dsh, or custom agent systems.

huangruiteng/loopx · 6,233 stars · on GitHub · huangruiteng.github.io

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add huangruiteng/loopx --skill loopx-pr-merge
Clone the repo
git clone --depth 1 https://github.com/huangruiteng/loopx

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for loopx-pr-merge

README.md
[![agentmods](https://agentmods.dev/badge/skills/huangruiteng/loopx/loopx-pr-merge/github.svg)](https://agentmods.dev/skills/huangruiteng/loopx/loopx-pr-merge)
Your own site
<a href="https://agentmods.dev/skills/huangruiteng/loopx/loopx-pr-merge"><img src="https://agentmods.dev/badge/skills/huangruiteng/loopx/loopx-pr-merge/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for loopx-pr-merge

Your own site · 80×15
<a href="https://agentmods.dev/skills/huangruiteng/loopx/loopx-pr-merge"><img src="https://agentmods.dev/badge/skills/huangruiteng/loopx/loopx-pr-merge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,370 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00065 $0.01370
Opus 5.5 $0.00026 $0.00548
Sonnet 5.5 $0.00013 $0.00274
Haiku 4.5 $0.00006 $0.00137

Measured 1mo ago against content hash e7734e5149de, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

loopx-pr-merge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/loopx-pr-merge/SKILL.md · 127 lines

How it starts

The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.

LoopX PR Merge

Optional maintainer workflow. It lives in the repository and stays outside the default installed skill set, so a host that never merges LoopX pull requests is not affected by it. Install or copy it deliberately when a host needs to make merge decisions.

The built-in pull-request-review capability owns review depth, evidence requirements, completeness, and verdict policy. This skill owns one narrower decision: whether this pull request may be approved or merged now, under which authority, and with what recorded validation.

Decision Precondition

A merge, approval, self-merge, or admin-bypass decision requires review evidence for the exact head being merged. A merge decision without this evidence is not authorized: a diff read, green CI, or pull-request metadata is not a substitute.

  1. Run loopx --format json pr-review --state all, or use the installed loopx-pr-review skill, and preserve agent_response_contract.review_execution_contract. Execute the review plan, review_template, and evidence_commands it names for every changed surface.
  2. Apply completion_gate literally, and re-read the remote head immediately before the decision.
  3. Immediately before the merge, run loopx --format json pr-review --repo OWNER/REPO --check-merge-readiness NUMBER@HEAD_OID. Merge only when it returns ready=true for that unchanged head.

A rebase or head update restarts review, and admin bypass never overrides this gate: it needs explicit owner authorization and never substitutes for the evidence.

Configured CI Waiting

Pass --goal-id GOAL for managed merges and follow resolved wait_for_ci. The default is true. When false, do not query, poll, or wait for CI; complete required local validation and exact-head review/thread checks. GitHub BLOCKED then reports separately authorized admin bypass, never permission to merge.

Decision Workflow

  1. Read the repository AGENTS.md, the pull-request diff, the changed paths, the local validation results, and the latest comments.
  2. Confirm that the repository's own self-merge policy covers the changed surfaces. The usual LoopX shape is single-purpose and validated work with no private state, no public evidence-policy change, no destructive git action, and no unreviewed runtime, permission, benchmark, or storage-authority behavior.
  3. Write the product and architecture judgment below, then produce the exact-scope change-quality receipt when the goal enables that policy.
  4. Decide: approve, self-merge with owner authorization, request changes, or hold for the maintainer path. Record the decision on the pull request with the changed surfaces, the checks that ran, failures and skips, manual holds, and the reason that coverage is enough. Record it as a published review on the exact head, not as a summary in another channel: on an author-owned PR GitHub blocks formal self-approval, so the record is the COMMENTED review carrying the approval conclusion and the English verdict. A self-merge whose head carries no such record is a process gap to repair, not an authorized merge.
  5. After the merge, sync the local default branch, leave unrelated dirty worktree state alone, and update LoopX todo or evidence when the work is tracked.

Read the full file on GitHub · 127 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +5 lines e7734e5149de
  2. 1mo ago Changed · +7 lines b34aeac03379
  3. 1mo ago First seen · 115 lines · 65 tokens per session scan A 87332e929bfe

Subscribe to this mod's changes

loopx-pr-merge is a skill published in the GitHub repository huangruiteng/loopx (6,233 stars, last pushed 5d ago), licensed Apache-2.0. It adds 65 tokens to every session and 1,370 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.

Related

Other skills, from other repositories