Pruxel-V: Cognitive Defense & Self-Healing HITL Agent

Agentic test agent that self-heals broken UI selectors and keeps humans in the loop.

Comment

Inspiration

Automated UI tests are the safety net of every enterprise release — and they are brittle. When a target element's attributes shift under stress, obfuscation, or ordinary UI drift, automated tests fail with SelectorNotFoundException. Teams are left with two bad options: halt everything on any anomaly (expensive downtime), or fail silently (undetected risk). In high-stakes domains like core banking, where transaction integrity is constantly probed by state-fuzzing, this brittleness is a real operational liability.

We built Pruxel-V to prove a different model: a test agent that doesn't just detect breakage but recovers from it — repairing a mutated selector on its own, scoring its own confidence in that repair, and escalating to a human only when a critical threshold is crossed. It runs at the speed of native code, routes decisions through an explicit safety policy, and returns a deterministic verdict, exactly as a Test Cloud agent should.

What it does

Pruxel-V is an agentic test agent on UiPath Test Cloud that validates whether a UI automation can survive a target-selector mutation. In a single run it:

  • Detects anomalies from live telemetry — it computes the Shannon entropy of a rolling window of cryptographic ledger hashes streamed from a Rust gateway.
  • Routes the decision through an NVIDIA NeMo Guardrails policy that maps the entropy index to a risk vector and a TRIGGER_HITL / ALLOW decision.
  • Self-heals a broken UI selector using a weighted multi-attribute Levenshtein similarity score, accepting the repair only when confidence clears a safe threshold.
  • Keeps a human in the loop by raising an OS-level emergency approval gate before the protective action proceeds.
  • Returns a PASS / FAIL verdict via testing.VerifyExpression, the way a Test Cloud case must.

How we built it

Pruxel-V is a decoupled monorepo across loopback connections, with UiPath as the orchestration and verdict layer.

1. Ingestion Gateway (Rust, port 8080). Intercepts incoming transaction traffic and maintains an in-memory Merkle ledger, exposing the current root and a fuzzing trigger endpoint.

2. Cognitive Observer (UiPath Coded Test Case). DynamicTestRunner.cs is a native C# [TestCase] built on CodedWorkflow, structured as Arrange–Act–Assert. It polls rolling windows ($W = 10$) of Merkle roots and computes systemic disorder using Shannon entropy:

$$H(X) = -\sum_{i=1}^{n} P(x_i)\log_2 P(x_i)$$

3. Guardrails Engine (NVIDIA NeMo, port 8082). A Flask service hosts the NeMo Guardrails runtime. A registered Colang security action (assess_runtime_risk) is executed through the NeMo action dispatcher, mapping the entropy index to a risk vector and a TRIGGER_HITL / ALLOW decision. This runs entirely locally — no external LLM key required — so the decision path is deterministic and reproducible for a reviewer.

4. Self-Healing + HITL Layer (UiPath). When risk crosses the line, the agent scores structural similarity between the broken and candidate selectors across four weighted attributes:

$$M_i(T, C) = 1 - \frac{\text{Levenshtein}(T_i, C_i)}{\max(\text{len}(T_i), \text{len}(C_i))}$$

$$Score = 0.40\,M_{\text{App}} + 0.30\,M_{\text{Role}} + 0.20\,M_{\text{Name}} + 0.10\,M_{\text{Title}}$$

If $Score \ge 0.70$, the runtime accepts the repaired selector and proceeds; otherwise it falls back safely. The decision is gated behind a human approval dialog. In this prototype the selector mutation is simulated to demonstrate the healing decision logic deterministically; the similarity engine itself is production-grade.

5. Context Bridge (Node.js / TypeScript MCP). A Model Context Protocol server exposes project context so external coding agents can assist with the C# codebase during development.

Cloud orchestration. The Coded Test Case is published to UiPath Orchestrator (Automation Cloud) and linked to a UiPath Test Manager project on Test Cloud. Because the run raises an OS-level approval dialog, it executes on an attended robot session through UiPath Assistant — Orchestrator is the control plane, the robot executes locally, and UiPath issues the verdict.

Challenges we ran into

  • The runtime-licensing and sign-in maze. Connecting the local robot to the cloud control plane was the hardest non-code problem: a WebView2 render loop in the Assistant, a "You don't have a license" state, and a Personal Automation setup that left Enterprise robot setup: None. We resolved it by repairing the WebView2 runtime, then allocating an Attended / Automation Developer robot to the user so the package could publish and run.
  • Making the guardrail genuinely NeMo, not a stand-in. A naive version computed risk with a bare if and never invoked the runtime. We rebuilt it to register a Colang action and dispatch it through the NeMo action dispatcher — real runtime, no LLM dependency — and verified the TRIGGER_HITL decision end to end.
  • Tuning the healing threshold honestly. The convergence score for our mutated/candidate pair landed at $0.7445$. Rather than hand-fit the data to clear an arbitrary $0.75$ line, we set the confidence threshold to $0.70$ — a defensible operating point — and documented it.
  • Demo timing under fuzzing. The attack burst is short, so the entropy window has to catch the chaotic phase. We drive the fuzzing endpoint in quick succession while the test polls.

Accomplishments that we're proud of

  • A real, end-to-end Coded Test Case that runs on UiPath Test Cloud and returns a deterministic PASS verdict, with every major claim backed by runnable code.
  • A genuine NeMo Guardrails decision path that needs no API key, so any reviewer can reproduce it offline.
  • Multi-language synergy — Rust, C#, Python, and Node.js cooperating over loopback with UiPath as the orchestration and verdict layer.

What we learned

We learned how far UiPath Coded Test Cases can go as native Windows observers, and how to turn a mathematical signal (entropy) into a governed, human-supervised test verdict. We also learned that NeMo Guardrails can act as a deterministic policy engine via custom actions and the action dispatcher — not only as an LLM wrapper — which makes guardrail logic reproducible and demo-safe.

What's next for Pruxel-V

  • Real UI healing: read live selectors from UiPath UI Automation so the repair operates on an actual mutating application, not a simulated pair.
  • Full Colang flow execution: drive the autonomous defense protocol flow end to end with local embedding-based intent matching.
  • Test Cloud at scale: organize runs into Test Sets, wire results into Test Manager dashboards, and trigger on change/risk for true CI coverage.

Built With

Share this project:

Updates