Red2PR

Broken CI pipelines stall engineering teams every day, yet existing AI auto-fix bots cannot be trusted in production: they guess patches without ever reproducing the failure, weaken or delete tests just to turn builds green, risk leaking secrets in prompts, or push straight into protected branches. Red2PR is an open-source (Apache-2.0), self-hosted autonomous CI repair platform built on one core invariant: Proof Over Prose. An LLM may diagnose root causes and propose a surgical patch, but only deterministic, isolated sandbox execution can certify tests as passing before a human ever reviews a Draft Pull Request. How Red2PR works end-to-end: • Secret-Redacted Ingestion & Workflow Guardrails: Ingests failing GitHub Actions and GitLab CI runs pinned to the exact base commit SHA, redacts sensitive tokens before storing AES-256-GCM encrypted logs, and scans CI workflows under SEC-031 to automatically block unsafe autonomous repair on hazardous pipelines. • Dual Air-Gapped Rootless Sandboxes (Red → Green): A rootless mTLS container worker running with --network=none, zero write tokens, and zero API keys first checks out the base commit in Sandbox A to deterministically reproduce the exact failure (Gate V-01; non-reproducible flaky runs abstain as repro_unconfirmed instead of hallucinating patches). Only after baseline reproduction succeeds does Sandbox B apply the candidate diff and enforce green target/regression tests, lint/typecheck, protected-path policies, and zero test-weakening guards across Gates V-01 through V-06. • Cryptographic Evidence & Human-Controlled Publication: Every verified repair produces an Ed25519-signed EvidenceManifestV1 (Gate V-07), requires Step-Up TOTP MFA approval in Approval mode, publishes strictly as a Draft Pull Request on an isolated branch (auto-merge is permanently disabled), reconciles remote GitHub Actions checks on the exact published commit SHA (Gate V-08), and records every action in a tamper-evident hash-chained audit ledger. Live Overview & Docs: https://nguywnben.github.io/red2pr