Atlas

Inspiration Every incident tool we had ever used stopped in the same place: a confident theory. "Here is probably what broke." After that, a human burns the night proving it, writing the fix, and hoping the fix actually holds. AI was supposed to make this better. Mostly it made it faster and more convincing, because a model will happily tell you, in beautiful prose, that it fixed your bug. It just cannot show you.

So we flipped the burden of proof. We wanted a system where "I fixed it" is a claim that has to be earned. Not "the model is confident," but "a test that failed a minute ago now passes." That one shift, proof before ship, became the whole project. We decided early that if we could not do it honestly, we would rather not do it at all.

What it does Atlas is a closed-loop delivery OS that carries a single incident all the way from "what broke?" to "here is a fix, and here is the test that proves it." It runs as seven agents around one loop, each handing off to the next.

It starts before anything breaks. Release Commander reads your codebase and tells you where it will fail first, quoting the actual code, naming the mechanism, and describing the alert you would see at three in the morning. When you deploy, Flight Recorder records every deploy, migration, and flag toggle into one ordered evidence log. If something goes wrong, the Investigator reconstructs the causal chain from that evidence and stays honest about its own certainty, labeling every link as observed, inferred, or uncertain. TimeShift then replays the timeline you did not take, the counterfactual where the flag stayed off, so you can see the incident you avoided.

The center of gravity is ProofPatch. It clones the real repository, reproduces the failure inside an isolated container, lets Codex repair the source, and re-runs the exact same test. A patch is only ever considered ready when it failed before the change and passes after it. Anything short of that never reaches you. Finally, Recovery and Engineering Memory close the loop: the postmortem writes itself from the same artifacts, and the memory is something you can actually talk to, answering questions from real commits, pull requests, incidents, and even the Slack threads your team uploads.

None of it is mocked. Real repositories, real test execution in a sandbox, real pull requests.

Try it yourself No login is needed for the guest sandbox: open the live demo and click Deploy to watch the whole loop run on real GPT-5.6 and Codex. To test the authenticated features on a real GitHub repository, sign in with email raomuhammadfaizananwar@gmail.com and password punjabkaiju1. The workspace already has a repository connected, so there is nothing to set up.

How we built it The frontend and orchestration are Next.js 15 on the App Router, running as one long-lived Node process rather than serverless functions, because a proof engine needs to stream live rather than cold start. Every agent pushes its progress over an in-process run bus and out through Server-Sent Events, so you watch the reasoning unfold in real time.

The agents are built on the OpenAI Agents SDK and the Codex SDK. We use GPT-5.6 for reasoning (the Investigator, Release Commander, Engineering Memory, and the adversarial reviewer) and Codex for the actual repair and for deriving a failing test from a predicted risk, with a Gemini fallback for when a provider is unavailable. Engineering Memory is a grounded retrieval agent over embeddings of the whole engineering corpus. Everything stateful lives in Supabase on Postgres.

The heart of the whole thing is the sandbox. Untrusted repository code runs inside Docker with every capability dropped, no network, no new privileges, and hard limits on CPU, memory, and processes, and the container is destroyed the moment it is done. Just as important, before any repair happens we freeze the environment by hashing every manifest, lockfile, and CI config, so a fix cannot quietly change how the project is built and slip past the proof. It all ships on an Oracle VPS behind Caddy for automatic HTTPS.

Challenges we ran into The first and hardest was making the proof impossible to game. A fix that edits the test is not a fix, so we drew hard lines: the test has to genuinely fail first, the environment is frozen the instant setup ends, and test files are immutable during the repair. If the "after" run so much as touches a test, the patch is refused.

Running an AI on real code without opening a hole was next. Codex's default sandbox relies on bubblewrap, which quietly fails on hardened Linux hosts, and the model would edit nothing while still reporting success. We solved it by moving model execution onto the host while keeping the actual proof locked inside the container, so our safety never depended on the model's own sandbox.

Then there was what we started calling the honesty tax. This is a proof product, and a single faked chart or rigged test would invalidate the entire premise, so again and again we chose the smaller, real version over the bigger, simulated one.

The subtlest challenge came when we let Release Commander prove its own predictions into pull requests. Suddenly Atlas was writing both the test and the fix, a real conflict of interest. We defended it structurally, freezing the environment before the test is even written, committing the test on its own before any repair, and allowing the fix to touch source only. On top of that we added an adversarial reviewer whose entire job is to veto a proof that is technically green but does not actually mean anything.

Accomplishments that we're proud of More than anything, we are proud that the loop is real. Atlas has opened genuine pull requests on real repositories whose fixes are gated on a test that provably failed and then passed. We built a sandbox we would trust with a stranger's code, and a freeze mechanism that turns "the before and after compare the same thing" from a hope into a guarantee. We are proud of an Engineering Memory you can actually interrogate, one that answers who changed something and why from real Git history. And underneath all of it, we refused to fake the one thing that matters: every proven claim in Atlas is backed by an execution you can run again yourself.

What we learned The biggest lesson was that the hard part of trustworthy AI is not generation, it is verification and the discipline to refuse to fake. A model that can reason is cheap now. A system that can prove is the actual moat. We found that all the interesting engineering lived in the guardrails rather than the intelligence: the freeze, the immutable test, and the "unproven, needs a human" path that we came to see as a feature rather than a failure. Saying "we could not prove this" out loud is exactly what makes the times we can prove it worth believing.

What's next for Atlas The nearest step is extending the proof gate from incidents to predictions, turning a Release Commander finding into a reviewed draft pull request, but only when a derived test actually reproduces the risk. That work is already live. Beyond that, we want to ground Flight Recorder in real telemetry, feeding it live metrics, logs, and traces so the causal graph is built on signal rather than deploy events alone. We are also planning a proper multi-tenant worker with a micro-VM boundary, so real repository execution can run safely for whole teams. And we will keep widening the sandbox to more languages, with a reviewer that only gets harder to fool.

Built With

• codex
• embeddings
• next
• supabase