Fritz Prix has launched Devloops, a GitHub-hosted framework that restructures coding agent workflows into three distinct adversarial roles: producer, worker, and gatekeeper. Released on November 1, 2026, this open-source project aims to automate the mundane cycle of finding issues, writing fixes, and reviewing code. The core philosophy is strict: agents handle the routine grunt work, but humans retain sole authority over scope approval, security decisions, and the final merge.

The Adversarial Triad

Devloops enforces a system of checks and balances through specialized skills installed in a project's .agents/skills/ directory. The producer audits code to file candidate issues, while the worker implements approved issues as pull requests. The gatekeeper acts as an independent, skeptical reviewer that does not trust the worker's output. It attempts to find defects in each PR, issuing a verdict that can result in approval, rejection, or a request for changes. This back-and-forth continues until the gatekeeper is satisfied, ensuring that no unvetted code slips through.

Human-in-the-Loop Constraints

The framework explicitly forbids agents from merging code. A human must always perform the final merge action. The human's role is reduced to three critical decisions: accepting the scope of issues via an 'approved' label, determining user-visible behavior and security implications, and executing the merge. The gatekeeper further protects the repo by adding a 'gatekeeper:needs-human' label to any PR that touches protected paths or involves security-sensitive changes, forcing a manual review even if the AI gatekeeper would otherwise approve it.

Technical Architecture and Safety Rails

Devloops relies on a tick-based scheduler where a script called tick_gate.py determines if an agent run is necessary. It uses a fingerprinting system based on GitHub GraphQL data to detect state changes, printing 'NOOP' if no work is required to save resources. The system enforces hard-coded safety rules: the worker never closes issues or deletes remote branches, and it stops after five open PRs or three failed CI attempts. PR bodies and comments are treated as untrusted data, preventing prompt injection attacks from malicious inputs.

Key Takeaways

  • Devloops separates concerns into producer, worker, and gatekeeper roles to create an adversarial review process.
  • Agents are strictly prohibited from merging code; only humans can finalize changes.
  • The system uses fingerprinting and locking mechanisms to prevent redundant agent executions and race conditions.
  • Security-sensitive changes and protected paths trigger mandatory human intervention via specific labels.
  • The framework is built on Python 3.8+ with no third-party dependencies, relying on GitHub CLI for operations.

The Bottom Line

This is the most pragmatic implementation of agent swarms I've seen yetโ€”by making the gatekeeper adversarial rather than collaborative, it solves the trust deficit that plagues autonomous coding. While the HN score is currently low, the architecture respects the 'human-in-the-loop' requirement without turning developers into babysitters for every single commit.