This is the right instinct. The missing layer is usually a tighter repo contract: what commands are allowed, what paths are off-limits, what verifier must pass, and what counts as enough change before another retry is admitted. A lot of ugly loops are just the same failure wearing slightly different wording.