CI Doctor

What the company appears to be: CI Doctor is a self-reported AI-powered system designed to repair broken CI (Continuous Integration) pipelines by generating sandbox-validated pull requests. It uses GPT-5.6 and Codex for diagnosis and repair, with strict policy gates and Docker-based validation before any GitHub write access is granted.

What changed: The project description indicates development of a security-first AI CI repair system that addresses the tension between accelerating developer workflows through AI and maintaining production security. It was built as part of an OpenAI 2026 hackathon submission.

Single most important open question: Is there evidence of real-world usage, traction or customer feedback beyond the hackathon submission? The description states no revenue, customers or adoption data are available.

The description states CI Doctor is "a security-first AI CI repair system" that processes failed GitHub Actions workflows. It claims to convert a real failure into an evidence-backed, sandbox-validated pull request through the following steps:

• Validation of webhook HMAC and repository allowlist
• Recording append-only incident trail with pattern-redacted evidence
• Use of GPT-5.6 for structured diagnosis
• Use of Codex for repair and regression-test proposal
• Policy gates restricting commands, writable paths, protected files, file count, changed lines, wall-clock time, and retry attempts
• Docker-based validation in a network-sealed environment with no GitHub write credentials
• Separate GitHub App broker opens PR only after validation proof exists

The system is described as an event-driven TypeScript application built with Fastify, Zod, PostgreSQL, and Docker. The author states that the system includes a fixture repository with realistic failures and produced a real validated repair and bot-authored pull request (PR #4).

The description states CI Doctor was inspired by "that tension: how can an AI repair a real CI failure without becoming a new production security risk?" This positions it as addressing a specific pain point in developer workflows where AI tools must be trusted but not given unrestricted access.

The claim evolution shows:

• Initial problem: broken CI pipelines are expensive and require manual translation of failure logs
• Proposed solution: AI acceleration with security boundaries
• Core positioning: "AI can propose. Evidence decides. Humans approve."

The author notes they avoided the "AI wrapper" trap by separating proposal, execution, and publication authority.

Not evidenced. The description does not identify specific target customers or ideal customer profiles beyond general developers working with CI pipelines.

Not evidenced. There is no mention of pricing models, revenue streams, or business model assumptions in the self-reported description.

The description states:

• Built as an event-driven TypeScript application
• Uses Fastify and Zod for API
• PostgreSQL stores incidents, events, artifacts, repair attempts, broker side effects
• Docker is execution authority (model output never marks repair successful alone)
• GitHub Actions failure → HMAC verification + repository allowlist → append-only evidence record + pattern redaction → GPT-5.6 structured diagnosis → Codex repair and regression-test proposal → policy gate → network-sealed Docker validation → separate GitHub PR broker
• Includes fixture repository with realistic failures across null handling, pagination boundaries, async ordering, and type assumptions
• Public proof dashboard shows recorded verified incident for judges without exposing credentials

Not evidenced. The description states this was submitted to the OpenAI 2026 hackathon and contains no information about revenue, customers, adoption, or traction beyond the hackathon submission.

Not evidenced. No mention of competitors or market context in the self-reported description.

• The system is described as a hackathon project with no evidence of real-world usage
• The author states "no revenue, customer or traction data is available beyond what they state"
• The system uses GPT-5.6 which is not publicly available (the author claims to have used it)
• The description does not indicate any production deployment, scalability considerations, or operational maturity
• No evidence of any security incident handling, monitoring, or observability systems
• The single-person team size raises questions about development velocity and operational capacity

1. What is the actual usage or adoption rate beyond the hackathon?
2. How does CI Doctor handle edge cases in CI failures that were not included in the fixture repository?
3. What are the specific policy constraints implemented, and how are they enforced?
4. Has there been any testing with real enterprise CI environments?
5. What is the current status of the Docker validation process and how does it scale?
6. How do you plan to handle model hallucinations or incorrect repairs that pass validation?
7. What are the specific security boundaries implemented, and how were they validated?
8. Are there any plans for integration with other CI platforms beyond GitHub Actions?