Day seven of the operator-via-MCP series — and the cleanest demonstration yet of the architectural shape loomcycle has been driving toward. Claude Code stays the operator and the conversation surface. loomcycle is the side runtime where the actual multi-agent work runs. Topology: a fresh Claude Code session in the jail git-clones loomcycle, then — using its own .claude/agents/code-reviewer.md and .claude/skills/code-review/SKILL.md as the seed — synthesizes a reviewer agent and a code-review skill for loomcycle. One loomcycle import claude-code --from=work/exp7/.claude --write --skills-dest=$PWD/skills later (the RFC C2 importer that maps the .claude/ shape onto loomcycle's content-addressed Defs — AgentDef + SkillDef), the operator makes one MCP call: spawn_runs(N=10, mode=join) (RFC Y, #464, v0.33.0, shipped today) — fanning 10 reviewers across 10 repo slices (internal/api/http, internal/tools/builtin, internal/providers, internal/store, internal/config, internal/snapshot, internal/scheduler, internal/, internal/channels, cmd/loomcycle). The reviewers run concurrently inside loomcycle, each parking findings in the Memory tool under user scope as a shared ledger. One more spawn_run wakes a consolidator that reads the ledger, merges 10 slices into one report, and returns. Result: 10/10 slices, 86 files, 35 issues — 1 Critical + 34 Important. The Critical: internal/channels/scheduler.go:81, a time.AfterFunc closure that can fire before the outer LoadOrStore commits → permanent pendCnt leak under sub-millisecond timer drift. Same-day fixes shipped: #462 + #463 resolved the Critical and most of the Important findings within hours. The Important set surfaced seven structural patterns worth naming: an newID() panic on collision (no retry), a ToolCtx goroutine leak when the call exceeds context, a restored d-runs status mismatch, a memory-quota check-then-write race, a MaxBytesReader OOM vector via inflated Content-Length, an interactive-goroutine semaphore leak on early return, and a Refresher.Stop() deadlock when the producer holds the same mutex. Three runtime findings surfaced by exp7 itself: Glob abs-path matching falls back to substring on relative roots (matches files outside the allowlist); cross-provider fallback drops reasoning_content when the secondary provider doesn't speak the same field; spawn_runs with N=10 against a single Anthropic-OAuth subscription tripped the per-key rate limit, surfacing the need for an operator-level fan-out throttle. The substrate-shaped path means the 10 reviewers run as real loomcycle agents, with scheduler reach, memory durability, OTEL spans, and per-run credential isolation, while Claude Code stays the human-facing operator. The contract between the two systems is the MCP wire surface — narrow, structured, well-defined. The substrate becomes the place where multi-agent work actually happens; the operator surface stays human-shaped.
The MCP attack your code review cannot see