Repo Fixer: an autonomous-dev platform for repository maintenance
An agent that reads a failing repository, plans a change, opens a reviewable pull request, and never merges without a human.
Context
Repo Fixer is our internal R&D bet on autonomous development: an agent that treats a codebase as its environment, its tests as its ground truth, and its output as pull requests instead of prose. It exists because we wanted to see what falls out of the pattern when the guardrails are taken seriously, not to replace engineers, but to hand them clean, reviewable diffs on the boring work.
The problem
Most autonomous-dev demos are impressive on hand-picked tasks and dangerous in a real repository: they invent APIs, ignore project conventions, and cheerfully rewrite things that already worked. The engineering problem: give an agent enough context to be useful, enough guardrails to be safe, and enough discipline to produce diffs a senior engineer would actually merge.
Constraints that shaped the build
- The repository is the world model: files, tests, and CI signals are the only sources of truth. No vibes-based edits.
- Every change ships as a pull request with a written plan, so a human reviewer sees intent before they read code.
- Nothing merges without a human: the agent proposes, engineering disposes.
- The agent respects existing conventions: it reads before it writes, and it is graded on how invisible its diffs look.
Architecture
The system, drawn honestly
A trigger (a filed issue, a red CI run, or a scheduled maintenance sweep) enters an admission layer that checks the task against per-repo scope rules, per-run token/time/dollar budgets, and concurrency quotas. Tasks that fail admission never spend a token. Admitted tasks index the repository into a code map (files, symbols, tests, ownership, recent changes) with secrets and generated artefacts explicitly scoped out of context, so the model cannot accidentally exfiltrate credentials it should never have seen.
The planner produces a written change plan with a risk classification (is this a config tweak, a public-API change, a schema migration, or a security-adjacent fix?) before touching a file. Editing runs in an ephemeral, network-scoped sandbox: a fresh checkout on isolated compute with outbound access limited to the registries the repo actually needs. Edits are dependency-graph aware, so touching a shared utility triggers regeneration of type checks and impacted-test discovery, not a hopeful full-suite retry. Test runs are deterministic (pinned versions, sealed environments, recorded seeds) so a green sandbox tomorrow reproduces a green sandbox today.
Before anything leaves the sandbox, a guardrail pass scrubs secrets, enforces policy rules (no license changes without approval, no touching files marked owned-by-humans), and blocks diffs whose risk label exceeds the repo's autonomy setting. The pull request lands with the plan attached, the risk label surfaced, the cost of the run declared, and links to the sandbox test artefacts, so a reviewer reads intent, sees risk, and knows what to look at first. Merge is a human decision, by design. Failing tests do not trigger optimistic retries; they re-enter planning with the failure attached, so the next attempt is a better plan, not a louder one.
Build notes
Decisions worth stealing
- Admission gates before generation: token, time, and dollar budgets are enforced per-task, per-repo, and per-day. The platform cannot silently spend its way to a bad answer.
- Repo indexing scopes secrets out of context by default: .env files, key material, generated artefacts, and files marked sensitive never enter the prompt.
- Plan-before-edit produced a step-change in review quality: reviewers argue with intent, not with code, which is where the good arguments live.
- Risk classification on every plan (config / public-API / schema / security-adjacent) determines whether the run needs an extra reviewer, a longer sandbox, or manual approval before the sandbox even runs.
- Dependency-graph-aware editing: touching a shared symbol expands the impacted-test set automatically, so a “small change” cannot claim green without exercising what it actually touched.
- Deterministic sandboxes: pinned toolchains, sealed environments, recorded seeds. A green sandbox is reproducible, and a flaky test is a signal to fix the test, not to retry the agent.
- Secret-scrubbing on outputs: PR bodies, commit messages, and posted logs run through a redaction pass so a leaked credential in a stack trace does not travel to GitHub.
- Cost of every run is published on the PR (tokens, time, dollars), so autonomy earns its keep in numbers reviewers can actually see.
- We deliberately did not build auto-merge: the value is the reviewable diff, and skipping review would delete the value.
- Convention-matching (formatting, import order, naming) is graded. An invisible diff is a merged diff.
Results
What we measure
- Merge rate of agent-opened PRs after human review
- Reviewer edits per PR before merge
- Time from trigger to opened PR, per task class
- Guardrail interception rate: plans and diffs the platform refused to ship
Repo Fixer is an R&D platform; anything we publish here will be measured against a labeled task set with source and date, not cherry-picked wins. Until then, the architecture is the evidence.