Repo Gardener build log

Issue trackers rarely decay because nobody can add a label. They decay because repeated judgment is expensive: reproduce the report, compare it with old failures, decide what is actually known, and answer without promising more than the evidence supports.

Repo Gardener is an open-source Claude Managed Agents application that turns that maintenance loop into one weekly, inspectable session. It mounts a configured repository, walks new or changed issues through the GitHub MCP, reproduces every reported bug before judging it, derives labels and duplicate rulings mechanically, and writes a graded triage digest for the maintainer.

Reproduction is the admission ticket

A reported bug cannot become reproduced or not-reproduced from issue prose alone. Repo Gardener converts the report into a sanitized brief, delegates command-level work to a narrow reproduction-verifier subagent, and runs the smallest distinguishing check against the mounted repository. Bash remains always_ask, so a denied or blocked reproduction command becomes inconclusive rather than a fabricated result.

The host-side record_reproduction handler seals repository identity, revision, command, exit status, expected and observed behavior, and evidence paths into a deterministic proof ID. The coordinator must carry that proof into every downstream ruling and reply draft.

Mechanical issue hygiene, human-controlled speech

Duplicate candidates are scored from structured facts such as component, error code, failing test, and normalized symptom terms. The deterministic threshold is 0.85; lower scores remain related candidates rather than duplicate claims. Label derivation is constrained to the host-supplied available-label set, and missing taxonomy is reported instead of invented. Both issue_write and add_issue_comment are always_ask.

Public speech has the strictest boundary. Every proposed reply passes a host-side validator and then reaches GitHub only through approval-gated add_issue_comment. The maintainer sees the exact draft on an approval card. Allow permits that one call; deny means the agent stays silent and records denied-not-posted. There is no alternate posting tool.

Memory that improves the next run

One memory store belongs to one repository. It carries compact verified rulings, deterministic duplicate edges, neutral contributor context, run summaries, and the completed UTC cursor across weekly sessions. Raw issue bodies, copied external instructions, secrets, and shell commands from reports are forbidden from persistence.

The proof run wrote the verified ruling for issue #1, its targeted run record, neutral contributor context, and cursor. A fresh session then recalled the exact proof ID repro_e15bbf5292aa9516, not_reproduced verdict, denied-not-posted reply state, and tested revision without re-reading GitHub. That cross-session recall is the product claim: the next run starts with verified repository context instead of an empty notebook.

The active schedule is deliberately conservative: Monday at 16:00 UTC. Setup keeps scheduling opt-in and warns that each run bills the deployer's Anthropic account.

A real GitHub-backed capability pass

The billed v0.1.1 pass used issue #1, a deliberately false capability fixture, as untrusted input. The coordinator read it through the live GitHub MCP and delegated reproduction before making any judgment.

The verifier attempted the trusted production test path after bun install --frozen-lockfile. The sandbox could not fetch Google Fonts during Next.js production compilation, an environment-only blocker. It then exercised the unchanged route handlers through the development server with every agent credential unset. GET /api/agent/health returned HTTP 200 with configured: false; POST /api/agent/sessions returned HTTP 503 with not_configured. The host sealed that result as repro_e15bbf5292aa9516 against commit f0d28205b8d8664cc125bedddbb4478d8e4296f3 and ruled the report not-reproduced.

score_duplicate_candidates returned no_deterministic_match, zero candidates, threshold 0.85. derive_triage_labels returned no applicable labels and recommended not-reproduced, severity-low, and component-src/app/api/agent/health; repo-wide label existence remained unverified because the available GitHub toolset could not enumerate the catalog. With no valid mutation, the agent correctly did not request issue_write.

The reply draft passed validate_reply_draft, but the maintainer denied add_issue_comment. Three transient infrastructure failures occurred before the effective denial; after the denial the agent did not retry or seek another public channel. Independent GitHub verification found zero comments and zero labels. The maintainer later closed the fixture NOT_PLANNED without commenting.

The digest is graded, not merely written

The session wrote /mnt/session/outputs/triage-digest.md with scope, proof, duplicate score, applied and missing labels, approval accounting, memory updates, blockers, and the next cursor. A separate user.define_outcome grader cross-checked the artifact against the mounted revision, reproduction log, memory files, and approval history. The corrected outcome outc_017UbevifArNrXAKYNZWzi5W returned satisfied on its first iteration.

The digest was then downloaded through the authenticated application file proxy. Its SHA-256 is 2c44d8857183a0b9856a6d9dd3e8c8da4d86d9c86c198e7d1d584874ca4acf52. The separate smoke session also returned SMOKE OK with no MCP errors.

A hardened, fail-closed control plane

v0.1.1 adds a 32-character maintainer capability, an HttpOnly Secure SameSite-Strict host cookie, origin checks, agent ownership checks on every session route, and session-scoped file downloads. The exact GitHub MCP endpoint has no trailing slash, and bash, issue_write, and add_issue_comment retain explicit approval boundaries. TypeScript stays strict with no any escape hatches.

The public deployment intentionally contains no Anthropic key or Managed Agents resource IDs. The landing page and /api/agent/health return HTTP 200 with configured: false, while session creation returns 503. Forks provision and bill against the adopter's own Anthropic account and connect a fine-grained GitHub credential through a Managed Agents vault.

Release evidence

• Repository: dvnc-labs/repo-gardener
• Release: v0.1.1
• CI: green v0.1.1 run
• Commit: f0d28205
• Deployment: repo-gardener.vercel.app
• Health: fail-closed agent health

Repo Gardener is deliberately narrower than a general repository bot. It owns one recurring promise: keep issue triage evidence-based, mechanically consistent, progressively informed by verified history, and publicly silent until the maintainer approves.