AI-assisted developer tooling
PatchPilot X
From an engineering alert to a patch backed by reproducible tests.
Workflow orchestration, verification, and developer interface
Python · FastAPI · React · Docker · Pytest · GitHub API
Open-source remediation demo
OVERVIEW
A remediation demo that follows an alert through reproduction, root-cause localization, candidate patches, sandbox verification, and a PR artifact. Test execution determines whether a candidate succeeds; an optional LLM summarizes the evidence afterward.
Architecture
- 01ALERT → REPRODUCE
A regression test must fail before a patch.
- 02LOCALIZE → PATCH
Demo-specific candidates target the failure.
- 03VERIFY IN SANDBOX
Targeted tests and the full suite decide success.
- 04PR ARTIFACT
Evidence is written locally; GitHub is optional.
BOUNDARYThe optional LLM report is downstream of verification. It cannot set test results, candidate scores, or verification status.
FastAPI orchestrates a copied repository workspace, reproduction test, candidate tournament, command results, and inspectable artifacts. A React console presents incident state and evidence.
The default runner executes locally. Optional Docker mode runs Python commands in a container and records an explicit fallback reason if it returns to local execution. GitHub PR creation requires configured credentials; absent or failed integration produces a local PR artifact.
Key decisions & trade-offs
A reproduction that already passes is rejected. Candidates are compared using targeted and full-suite test results, with deterministic scoring and recorded diffs.
The current security and payment-regression demos use predefined tests and patch strategies. This makes the workflow reproducible, but does not demonstrate open-ended LLM code repair. Optional AI reporting uses schema validation and a deterministic template fallback.
Verification / results
The verifier reads command outcomes for both the targeted regression and full test suite. The resulting artifact includes before/after verification, the selected diff, candidate comparison, and trace information.
Two runnable demo scenarios cover disabled JWT signature verification and a blocking delay in a payment path. They demonstrate the workflow within those examples, not a remediation success rate across arbitrary repositories.
Limitations
The local runner executes repository code on the host. Docker is optional, and its fallback does not provide container isolation. Use trusted demo repositories. Credential gating is not a separate human-approval system; real PR mode requires deliberate configuration.