dependency-health-loop

A configuration of [loop-controller]. That skill supplies the loop machinery — primitive selection, the full guardrail stack, state externalization. This skill supplies the three things specific to "keep deps healthy": the per-pass recipe (audit → one safe bump → gate → PR), a mechanical proof that combines a security/freshness audit with a green gate after every update, and the HITL boundary that holds majors for a human. Read loop-controller for the guardrails; they're inherited, not repeated here.

Why disable-model-invocation: this loop edits the lockfile, commits, and pushes branches on its own, on a clock. It is user-driven — you want to type /loop 30m /dependency-health-loop (or /dependency-health-loop), not have Claude silently start bumping packages because an advisory landed.

The 5-part contract