CUSTOM RESOURCES ARE THE STATE MACHINE

Every finding gets a path to solid ground.

Patchy gathers related security alerts into Kubernetes Finding resources — each projected to a GitHub tracking issue — adds ownership context, and sends safe fixes through an isolated coding agent, with a human at the merge button.

zsh — install

$ helm install patchy
                                oci://ghcr.io/bitwise-media-group/patchy/charts/patchy \


                                    --namespace patchy --create-namespace

Get started → Star on GitHub

✓ No agent GitHub credentials ✓ Humans merge every fix ✓ No shadow state store

payments/api #184

SQL query built from user-controlled value

security-severity: high security-finding: in-review security-advisory: CWE-89

✓ Finding openedCodeQL · alert #472

✓ Context enhancedowner: payments-platform

✓ Investigation complete92% confidence · claude

4 Pull request in reviewPR #231 · checks passing

1 hourALERT ACCUMULATION WINDOW

0AGENT FORGE CREDENTIALS

6SEPARATE GO BINARIES

1HUMAN MERGE DECISION

// THE FINDING LIFECYCLE

Phases move the work. The cluster keeps the truth.

No shadow database and no mystery queue. Every transition is a phase edge on the Finding — kubectl get findings -w is the whole pipeline, live.

Opened Alert lands

Enhanced Owner added

Investigating Agent assesses

Queued Slot awaited

InReview PR opened

Remediated Patch merged

↳ HandedOff A safe automated patch was not possible — hand back to the repository owner.

// SIX BINARIES, ONE SYSTEM

Separate concerns. Shared ground.

Each component owns a narrow set of phase edges. The agent never talks to GitHub and never receives forge credentials.

Custom resourcesthe only state store source of truth

integration-controller

Webhooks in · Findings ingested · issues projected

source-controller

Repositories pinned · tarballs served to the sandbox

context-controller

Ownership and infrastructure context added

investigation-controller

Findings gated · analysis Jobs run · verdicts routed

remediation-controller

Queue scheduled · fixes pushed · PRs opened

agent-runner

Investigate and patch inside the isolated pod

// THE PATCHY RULES

Automation with edges you can see.

Let related alerts gather

Alerts of one advisory family accumulate into a single Finding for an hour, so one weakness becomes one useful tracking issue instead of forty noisy ones.

Context before code

Repository ownership and infrastructure relationships arrive on the finding before the investigation decides a route.

Keep the agent fenced in

The coding agent works inside an ephemeral Kubernetes Job with no forge credential at all — the repository arrives as a digest-verified tarball, and the model key is the only secret in the pod.

Humans finish the repair

High-confidence fixes become branches and pull requests. Patchy opens them; people review and merge them.

// THREE STEPS TO YOUR FIRST PATCH

Create the GitHub App

Settings → Developer settings → New GitHub App

Create the secrets

App credentials plus the webhook HMAC, and the model API key.

$ kubectl -n patchy create secret generic patchy-github …

Install the chart

One Helm release: CRDs, five controllers, RBAC, network policies.

$ helm install patchy oci://ghcr.io/bitwise-media-group/patchy/charts/patchy