Graft AI

The problem

Every API provider ships breaking changes and hopes customers read the changelog. They don't. At AWS, over 30% of service downtime traced to external API and package changes going unnoticed.

Concretely: Stripe's Basil release moved current_period_end off the Subscription object. Nothing crashed. The field just returns undefined, so billing dates silently went wrong in production apps.

Dependabot makes this worse: it bumps your SDK version and hands you a broken build.

What it does

Graft AI watches a provider's published OpenAPI spec, finds every affected line in your code, patches it, proves the fix works in a sandbox against the live API, and opens a PR with that evidence attached.

The detection step reads a provider's published spec, so the approach is not Stripe-specific, though Stripe is the only provider wired up today.

Why it isn't a regex

Five real repos. Seventeen lines match current_period_end. Only nine are actually affected.

The rest are a SQL column, a database migration, a Knex row, and a Redux selector. They carry Stripe's field name because someone copied it years ago. At the call site they look identical. Patch them and you break eight working code paths.

Graft traces where each value came from, not what the line looks like. stripe.subscriptions.list() gets patched. db('subscriptions').first() does not.

Hardest case in the corpus, where the key and value share a name and only the value may change:

before:  current_period_end: subscription.current_period_end,
after:   current_period_end: subscription.items.data[0].current_period_end,

Measured

• Classifier verdict accuracy 95.24% on a 21-case labelled dataset, weighting false positives as the worse error because that is the one that corrupts code
• Patch correctness 100%
• Five repos scanned in 17 to 27 seconds for about half a cent
• Sandbox proof in under 5 seconds

Sponsor tools

• Fireworks AI classifies and patches. Cost per repo scanned is the unit economic of fanning out across thousands.
• Daytona runs the proof against the live Stripe API. Old accessor returns undefined, new one returns a timestamp.
• CodeRabbit independently reviewed Graft's own PR, so we are not the only judge of our output.
• Braintrust scores the classifier and surfaced two real gaps we did not paper over.
• CopilotKit is the dashboard, streaming every verdict with its provenance trace so a human can audit it.
• ElevenLabs narrates the demo.

Limits

Scoped to the hackathon: one breaking change, one provider. Spec diff is precomputed, not polled. PR creation runs separately from the dashboard. The sandbox proves the accessor migration rather than running each repo's own tests, because none of them have any.

Built With

• braintrust
• coderabbit
• copilotkit
• daytona
• elevenlabs
• fireworks-ai
• nextjs
• openapi
• stripe
• typescript