Six choreographed steps. Two human approval gates. Zero black box. Tickets become reviewed, tested, merged solutions in minutes — with a complete audit trail at every stage.
Ships with four built-in roles. Switch between them to see exactly what each persona can do.
Every ticket follows this exact path. Every stage produces a visible artefact. Every approval is logged with a timestamp.
Developer selects a bug or task from their queue. Status moves to IN_PROGRESS. The whole team has immediate visibility — the ticket is now locked for this engineer and no one else will inadvertently pick it up mid-session.
The AI agent reads the ticket in full, searches the codebase using semantic + symbol search (pgvector + Zoekt), and identifies the root cause with supporting evidence — exact file paths, line numbers, and a confidence score. Every search query and every finding is recorded. The agent produces a structured analysis document before any planning begins.
A structured fix plan is generated — covering affected files, the proposed change strategy, risk assessment, expected diff scope, and a manual verification checklist. An LLM plan-critic judges the plan against 8 quality axes and scores it before it is ever shown to the developer. Sub-standard plans are revised automatically before reaching the approval gate.
Developer approves the plan. Without approval, no code is touched. This is the highest-value review in the pipeline. The developer sees the proposed approach, the files affected, and the risk rating — and explicitly approves or rejects. Rejection triggers agent re-analysis. Approval creates a signed, timestamped record and unlocks Stage 5.
Root cause summary · Affected files list · Proposed fix strategy · Risk level (Low / Medium / High) · Plan-critic score · Manual checklist · Approve / Reject / Request revision buttons
The agent implements the approved plan — producing multi-file unified diffs, unit tests, and an updated manual verification checklist. Every generated file is sandboxed: the agent builds and runs tests in an isolated Coder workspace with a per-bug git worktree. The developer sees live tool events via SSE as the agent works. The final diff set is held for approval — never auto-merged.
Developer approves the diffs. Admin pushes the branch. GitLab merge request opens automatically. The developer reviews every changed file line-by-line in the diff viewer. On approval, the SME (Subject Matter Expert) is notified to push the branch — developers never hold production access tokens. GitLab creates the MR, the ticket status moves to RESOLVED, and the full audit record is sealed.
Full multi-file diff viewer · Test output · Build status · Manual checklist results · Approve / Request changes · On approval: SME push notification triggers automatically
A custom-built agent runtime with stateful checkpoints, sub-agent fan-out, BYOK model routing, and HITL gates wired through every risky tool.
The two-gate model is the structural guarantee that separates professional AI-assisted engineering from "move fast and hope".
You approve the what and how before any implementation begins. Issues caught here cost nothing to fix. The same misunderstanding found in production can cost a week of rollback work.
You review the actual code changes — every modified file, every line — before they are merged. Developers never hold production access tokens. The SME pushes only after explicit diff approval.
Super Admin, SME, Developer, Auditor — with granular permissions across every resource, per-team and per-project scoping, and SCIM-ready user provisioning.
Every action timestamped and attributed. Token spend, model used, diff hash — nothing escapes the log. Phoenix trace integration, configurable retention, export to S3/SIEM.
Bring your own API keys for any supported provider. Route each agent role to the model that suits it — frontier reasoning, fast generalists, or your own on-prem weights via Ollama/vLLM.
Developers approve diffs. SMEs push branches. PATs are isolated and scoped per environment — developers never hold production access tokens. Dev/SME push split is architectural, not configurable.