CrossPatch

CrossPatch is a self-reported SRE incident response system that uses AI agents to investigate reliability failures and propose fixes, but separates reasoning from execution authority. The system implements a due-process layer where AI specialists review incidents and generate verdicts, while human approval and deterministic software handle patch application and verification.

The author states CrossPatch is built with GPT-5.6 agents and includes a hash-bound warrant mechanism to prevent unauthorized execution. It currently demonstrates two webhook reliability scenarios against its own sandboxed victim service.

The single most important open question is: What real-world SRE or platform teams are using this system, and how does it integrate into existing incident workflows?

This analysis is based entirely on the self-reported project description provided by the author — no external verification or traction data is available. The description contains claims about functionality, design decisions and performance outcomes, but none of these can be confirmed without independent evidence.

The description states CrossPatch is a "failure-first SRE incident room and a due-process layer for agent-proposed fixes." It turns incidents into controlled sequences involving:

• Evidence collection and sanitization
• Five GPT-5.6 specialists reviewing incidents:
  • Prosecutor (Luna)
  • Inspector (Terra)
  • Counsel (Terra)
  • Magistrate (Sol)
  • Bailiff (Luna)
• A human gate that approves hash-bound warrants before execution
• Deterministic software that applies patches and runs tests independently

The system uses "MCP surfaces" with deliberately different authorities:

• Evidence MCP: private, read-only, sanitized
• Broker MCP: exposes only 'execute_warrant(id)' to Bailiff
• Judge MCP: read-only projections of published cases

CrossPatch currently ships two webhook reliability scenarios against its own sandboxed victim service.

The author claims CrossPatch addresses a gap in current autonomous coding-agent demos, which they say "left me with a harder question" about whether the same model should be allowed to investigate, propose repairs, execute them and decide its own work passed.

The positioning is that it explores "that missing layer" of trustworthy evidence, separation of responsibilities, explicit human authority, deterministic execution and proof inspection. It positions itself as a system for SREs or platform teams who need "trustworthy evidence" rather than just plausible patches.

The claim evolution appears to be: from a general AI agent demo pattern → to a specific due-process architecture → to a system that separates reasoning from execution authority.

The description states CrossPatch is designed for SRE or platform teams who need "trustworthy evidence, separation of responsibilities, explicit human authority, deterministic execution and proof that can be inspected afterwards."

It targets organizations with reliability incidents requiring formal review processes. The author notes it's built for "SRE or platform team" needs specifically.

No specific customer segments, personas or use cases beyond SREs are detailed in the description.

Not evidenced. The description does not contain any information about pricing, monetization, revenue streams or business model.

The system is built with:

• Python, FastAPI, PostgreSQL, SQLAlchemy
• Next.js, React, TypeScript
• Docker Compose for local topology
• Caddy as host ports publisher
• OpenAI Agents SDK with Responses API
• GPT-5.6 models used in two ways:
  • As reasoning layer inside specialists
  • Through Codex as implementation and review collaborator

The architecture includes:

• Sanitized evidence boundaries
• Hash-bound warrants
• Single-use nonce binding
• Immutable test plans
• Trusted external observers for verification
• Separation of model authority from execution authority

Not evidenced. The description does not contain any information about customers, revenue, usage metrics, adoption rates or product maturity beyond the author's own claims.

Not evidenced. The description does not mention competitors, market positioning relative to existing tools, or competitive landscape.

• Unverified claims: All described functionality and performance outcomes are self-reported without independent verification.
• No traction evidence: No customers, revenue, usage data or adoption metrics are provided.
• Single-person team: The project is built by one person (Asad Ali), which raises questions about scalability and ongoing maintenance.
• Limited scope: Currently only demonstrates two webhook scenarios against its own sandboxed service.
• Unproven human gate: While described as critical, the actual effectiveness of the human approval process in real-world use is not demonstrated.
• Self-contained demo: The system runs against its own sandbox victim service; no integration with external systems or real observability platforms is shown.

1. What specific SRE or platform teams are currently using this system, and how do they integrate it into their existing workflows?
2. How does the system handle edge cases or failures in its own architecture (e.g., model hallucinations, boundary violations)?
3. What is the actual human approval process like in practice? How long does it take to review warrants?
4. Are there any known limitations or constraints that prevent broader adoption?
5. What are the plans for integrating with real observability platforms and issue trackers?
6. How does CrossPatch handle multi-team or organizational approval policies?
7. What is the current development roadmap beyond the two bundled scenarios?
8. How does the system ensure that the AI specialists don't inadvertently leak information through their reasoning processes?