I’m not advocating for no source control, but you can avoid loops like this with Architectural Decision Records. If you’re real lazy, let the agent maintain the ADRs and they will usually call out when these “painted into a corner” scenarios happen and you can then reason them around it.
Right. But how to prevent adversarial agents working on the same code base from treating the ADR list as a form of malicious message exchange?