ranade-oss gives trusted agent pull requests a tightly fenced repair loop

Routine failed checks can now trigger a small AI-proposed fix, without handing the AI the keys to the repository.

workflowsecurity

The fork adds a repair route for failed baseline checks on trusted, same-repository agent pull requests. One runner reads the failure and proposes a minimal patch; a separate clean environment checks it and makes any commit.

  • Automatic changes can touch application work, ordinary tests and routine scripts.
  • Sensitive territory is off limits: security, deployments, workflows, dependencies, migrations and governance changes all require a person.
  • Each pull request gets at most two repair commits, and only if nobody has changed its head in the meantime.

If the fix cannot stay within those guardrails, the process stops and flags human intervention.

So what Teams using AI-assisted coding should care if they want faster recovery from routine breakage without quietly automating high-impact repository changes.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?