Closed loop

The agent loop, end-to-end.

Every Mendhelm action is one pass through the same five phases — detect, diagnose, propose, apply, report. Diff first, dry-run, promote, audit, surface it on Monday. No silent fixes; no out-of-band writes; no Monday-morning surprise because the loop closed over the incident overnight.

closed loop
dry-run first
monday digest

The loop, visualized

Five phases. One cycle. Closed on every incident.

The closure arrow matters most: every digest.row feeds back into the next evidence.record, so the agent learns the shape of your week rather than responding in isolation.

loop · 5 phases · 1 cycleclosed every incident
01DETECT02DIAGNOSE03PROPOSE04APPLY05REPORT

Section 01 · The five phases

Every agent action is one pass through the same five phases.

The codes are stable across the site — an audit row, a digest entry, a Slack alert — so when you see 02 · DIAGNOSE on Monday you know what kind of evidence produced it.

step / 01loop · 01

DETECT

Diff declared vs. provisioned state across every connected cloud account.

producesevidence.record
step / 02loop · 02

DIAGNOSE

Read the diff against the last-approved manifest + the change window. Match it to a configured drift-class.

producesintent.diff
step / 03loop · 03

PROPOSE

Generate the dry-run envelope. Pin scope, pin intended diff, pin the reviewer policy.

producesplan.envelope
step / 04loop · 04

APPLY

Promote after the policy window (or human ack). Roll back if the actual diff diverges from intent.

producesexecution.outcome
step / 05loop · 05

REPORT

Roll the daily evidence up into the Monday digest row, signed and addressable.

producesdigest.row

Section 02 · End-to-end walkthrough

A security group that tried to drift back into prod at 3 AM.

One incident, walked through all five phases. Timestamps are real-shaped; the resource names are a representative scenario. The same loop runs whether the drift is a security group, a K8s config map, an IAM policy, or a tag that fell off overnight.

walkthrough · eu-west-1 · checkout-prod-rds
3 AM · 60s policy
  1. [03:00:14 UTC]
    01 · DETECT
    actual vs. declaredevidence.record

    The eu-west-1 check loop flags that the security group on checkout-prod-rds has drifted: ingress rule 0.0.0.0/0 :5432 reappeared overnight after a Terraform apply outside the change window.

  2. [03:00:31 UTC]
    02 · DIAGNOSE
    diff = 1 line addintent.diff

    Agent fetches the last-approved manifest (signed off 12 days ago) and finds the rule explicitly removed there. Diff = one line add. No PagerDuty search: this matches the configured drift-class: security-group-regression.

  3. [03:00:48 UTC]
    03 · PROPOSE
    envelope · dry-runplan.envelope

    Proposed envelope: revoke the bad rule, restore 10.0.0.0/16 :5432, attach the diff to an audit record agent_id=reliability-bot, intent=regression-rollback. Server-side dry-run on the AWS control plane; diff only.

  4. [03:01:02 UTC]
    04 · APPLY
    observed · promotedexecution.outcome

    Promotion policy window for security-group-regression is 60s with no human required; agent applies, observes the new rule is gone, and posts a PR titled chore(tf): re-pin checkout-prod-rds ingress to 10.0.0.0/16 encoding corrected intent so the next apply can't reintroduce it.

  5. [Monday 09:00 local]
    05 · REPORT
    rolled up · mondaydigest.row

    The weekly digest rolls this incident up under Drift items · cleared and Healing actions · patch + roll_back. The audit row links to a representative sample row showing the exact shape on Monday.

Why this is the closed loop: evidence.record from 03:00:14 returned to observation at Monday 09:00. The audit row, the PR, and the digest row point at the same intent — so the next change window can't reintroduce the regression, even if the original Terraform file is touched again.

Continue the loop

See what a Monday digest row actually looks like — and what we promise about scope.

The sample report is the same shape Mendhelm ships every Monday. The trust page is the manifest of what the agent will and won't touch while running this loop on your behalf — and /status is the 90-day uptime envelope of the loop itself.

Read a real-shaped sample report →Permissions, dry-run, audit →See platform status →Compare head-to-head with Datadog →Compare the three tiers →See multi-cloud coverage →Read the reliability ops series →Read the latest changelog →Back to overview

closed loop · dry-run · audit · monday