Claude Agent

Starts withA ticket moves to "ready for infra", or someone pushes to the config repo.

1. CLAUDE AGENT

   Pointed at the config tree in plan mode, with the ticket text as the task. It reads the existing vhosts, writes the new one, and runs nginx -t against it.

2. CLAUDE AGENT

   Second turn of the same session, with a JSON Schema: { safe: boolean, diff: string, risks: string[] }. The answer comes back as data, not prose.

3. Contract

   Branches on {{$.claudeAgent.output.safe}}. Clean goes one way, anything with a risk goes the other.

4. Human in the Loop

   The risky branch parks, showing the diff and the agent's own list of what it might break. A person approves or sends it back with a correction.

5. SCRAPLI / Extrinsic

   Approved: the reload runs. Rejected: the reply goes back into the same agent session, which already knows what it proposed and why.

What you getThe agent did the fiddly reading, a person kept the decision, and the whole exchange is one run you can open six months later. The rejection round-trip is the part you can't get from a chat window — the second turn resumes a session that still has the first turn's context, so you argue with it rather than re-explaining.

Starts withA schedule, 02:00.

1. CLAUDE AGENT

   Reads the day's diff in a checkout on the plugin host and answers against a schema: findings, each with a file, a severity and a sentence.

2. Code

   Drops anything already filed, so the same finding doesn't arrive every night.

3. POSTGRES

   Writes what survived, so the trend is queryable.

4. JIRA

   Opens a ticket per high finding.

5. Gmail / Telegram

   One digest to the team, or nothing at all on a clean night.

What you getA reviewer that never gets bored, whose output is rows rather than a wall of text — and when it misjudges something, you edit the flow, not a prompt buried in a vendor UI.

Starts withA config-drift alert, or a weekly sweep.

1. SCRAPLI / osquery

   Collects what the machines actually look like right now.

2. DUCKDB

   Diffs today's snapshot against the baseline file. You get the rows that moved.

3. CLAUDE AGENT

   Gets the diff plus read access to the config repo, and answers the question the diff can't: is this drift someone intended, and what does it affect?

4. Human in the Loop

   Fires on the agent's "Needs a human" port when it can't tell — with its own question already written out in plain language.

What you getDrift detection usually gives you a list nobody triages. Here the list arrives with a reading of it, and the agent is explicitly allowed to say it doesn't know.