ForkSafe

Inspiration

Robot simulations fail in ways that look trivial and cost days. A pick-and-place arm clips a divider, and a good engineer burns hundreds of hours re-running the same scene, changing seeds, and tweaking controller constants. Half of that time is the re-run loop itself, not the thinking. We wanted agents to own the loop end to end: reproduce the failure, try repairs in parallel, prove a fix on tests the agents never saw, and leave the human with one decision instead of hundreds of iterations.

What it does

ForkSafe turns a plain-words description of a robot failure into a proven repair. You type what went wrong, it builds the scene, runs the physics in a cloud sandbox, and streams the simulation to your browser live. It then fans out repair agents across separate environments. The agents share findings through a live evidence store, submit exact controller revisions, and each candidate is graded on hidden test cases inside locked sandboxes the agents cannot touch. When a run finishes, a Jira ticket carries the candidates, the scores, and the agents' notes, and the reviewer approves or sends it back inside the ticket. Approving a fix makes it the next run's starting point, so the system learns across runs, not only inside one.

How we built it

Convex is the orchestrator: investigation state, job admission, budgets, leases, and the outbox that syncs evidence outward.
Daytona sandboxes run the MuJoCo physics, one fresh sandbox per experiment, plus a locked grader sandbox per withheld evaluation.
Factory Droid SDK runs the repair agents inside a runner pool hosted on Render.
SpacetimeDB is the shared evidence store for findings, experiments, candidates, and reviews; it is also how agents learn from each other's dead ends.
Elastic indexes every finding and experiment, and its Agent Builder answers "why did this fail" questions with citations that are re-validated against the canonical records before they are shown.
Atlassian Forge hosts a Jira issue panel with approve, reject, and request-more actions, an issue action to start an investigation by hand, and a trigger that starts one automatically when a forksafe-labeled issue is filed.
The web app is React with a Three.js replay viewer, live frame streaming, per-environment tabs, and honest mode labels wherever a path is not live.

Challenges we ran into

The hosted runner pool kept being OOM-killed at 512 MB whenever agent sessions ran in parallel; jobs burned retries and runs ended with no candidates. We moved the worker to a 4 GB instance and made the pool cap configurable.
A SpacetimeDB outage dropped evaluation results mid-run. We built delivery retries with dead-lettering, an operator sweep, and a "not saved" state in the UI, because unsaved results are not allowed to count toward approval.
Two submit-chain bugs made sessions look successful while rejecting work: a rejection counted as a submission, and cross-run finding citations were rejected even though they were offered as hints. Both are fixed and covered by tests.
The Jira create-issue event arrived without labels, silently skipping the auto-trigger; the handler now falls back to a REST label lookup and logs the outcome.
Keeping withheld cases actually withheld meant three fences: the eval sandbox runs separately, the agent's tool layer refuses withheld case ids, and the UI never streams withheld frames.

Accomplishments that we're proud of

The full loop works live in the cloud: describe in plain words, watch the failure stream in, watch agents repair it in parallel, grade on hidden cases, and gate the fix through a human in Jira.
Live simulation streaming: frames flow from the sandbox to the browser a second or two behind the physics.
Cross-run learning: an approved fix becomes the next baseline and prior findings return as hints to the next agents.
Evidence-only answers: the ask box cites real records and drops any citation it cannot verify, so it cannot invent sources.
Deterministic everything: same scene, same seed, same result hash, tied to an exact controller revision.

What we learned

Agents need a gate, not freedom. The useful shape is tight budgets, write leases so a dead attempt cannot overwrite a newer one, a grader the agents cannot reach, and a human approving an exact hash. Shared evidence beats shared context: agents got materially better when they could read each other's measured findings instead of working blind. And honest states beat polished lies: "result was not saved" builds more trust than a quietly missing line.

What's next for ForkSafe

More task families (we shipped three: divider pick-and-place, push-through-gap, and toss-into-bin), mobile review so an approval fits in a pocket, richer hints between runs, batch investigations over a scene matrix, and workspace-level learning so one team's fix helps the next team's similar failure.