ranade-oss puts guardrails around AI-powered repair

When automated checks fail on a trusted contributor's proposed change, the setup can ask Codex, OpenAI's coding assistant, to propose a narrow repair. The initial version kept that assistant too close to the power to make and publish changes.

The follow-up redesign draws a harder line. Codex can now inspect the failure and return a proposed patch, but cannot alter the project itself. A separate controlled step then checks that proposal before anything is applied: it rejects oversized changes, deleted or renamed files, binary material, and work touching sensitive areas such as authentication, secrets, deployment, legal materials, or project dependencies.

That matters because failure logs and proposed changes can contain untrusted input. The fork makes the AI adviser, not the final actor.