Skip to main content
PatchProof PatchProof

Deterministic patch verification

Turn every patch into reviewable proof.

PatchProof runs deterministic checks on infrastructure you control and turns the result into an evidence-backed verdict with redacted logs—so humans and agents know whether a change is ready to merge.

Create your first proof See how it works
  • Self-hosted execution
  • Deterministic first
  • Redacted logs

Example proof · PP-184

Harden workspace authorization

Review before merge
Execution
Completed
Static risk
High
Verdict
Warning

Merge recommendation

Review the authorization boundary and confirm the new test coverage before merging.

Evidence

7 signals
  • Build and tests4 deterministic commands passed 02:14
  • Health checkExpected HTTP status received 184 ms
  • Authorization code changedHigh-risk path requires review 1 finding

Provenance

Recorded
Commit
7f3c2a1
Runner
self-hosted · linux/node
Policy
.patchproof.yml
Evidence
Logs redacted · 2 artifacts

PatchProof operating principles

  • 01
    Verify the changeRun checks, inspect changed-file risk, and record what happened.
  • 02
    Keep execution yoursRepository code runs on a self-hosted runner, not in the cloud control plane.
  • 03
    Keep the proofReview a durable verdict with concerns, evidence, and provenance in one place.

From output to evidence

A passing command is not the same as a proven patch.

PatchProof joins execution results with deterministic risk and provenance, so the answer survives beyond one terminal session.

Without PatchProof

Evidence is scattered

  • Terminal output disappears with the session.
  • A green test run can hide a risky authorization or dependency change.
  • Reviewers reconstruct what ran, where it ran, and against which commit.
  • Humans and coding agents make the next decision from incomplete context.

With PatchProof

One patch produces one proof

  • Execution, static risk, and merge verdict remain distinct.
  • Top concerns point directly to the evidence needing review.
  • Logs and metadata are redacted before presentation.
  • Commit, runner, policy, and timing travel with the result.

A deliberate trust boundary

The cloud coordinates. Your runner executes.

PatchProof Cloud owns teams, projects, run plans, redacted logs, artifacts, and reports. It does not clone repositories, run project commands, or receive a Docker socket.

A compatible self-hosted runner claims each job, works inside a per-run directory, applies bounded timeouts, redacts output, and cleans up the workspace it created.

Explore the security model
Control-plane orchestration and self-hosted execution remain separate by design.

Anatomy of a proof

Understand the decision before opening the raw logs.

The proof starts with the smallest useful answer, then lets reviewers move into the evidence behind it.

Decision

Execution completed. Risk is high. Verdict: warning.

PatchProof keeps these fields separate because a run can execute successfully and still uncover a change that deserves review.

One verification lifecycle

From patch to evidence-backed verdict.

  1. 01

    Define the policy

    Describe commands, required environment names, risk rules, URL checks, timeouts, and artifact patterns in .patchproof.yml.

  2. 02

    Inspect the patch

    PatchProof records changed files and applies deterministic rules for sensitive paths, dependencies, CI, tests, and configuration.

  3. 03

    Run the checks

    The authorized checkout runs on your machine for local verification or inside a bounded self-hosted runner workspace.

  4. 04

    Assemble the proof

    Execution results, risk findings, redacted logs, artifacts, and provenance become one durable report.

  5. 05

    Act on the verdict

    A human or coding agent can merge, fix, retry, or escalate with the evidence still attached.

Early-access capabilities

Useful today. Honest about what comes later.

PatchProof 0.1 is manual-first: the core local and self-hosted verification loop exists now, while integrations and hosted execution remain future work.

Available now

The evidence loop

  • Local working-tree scan and verification
  • Manual cloud runs on self-hosted runners
  • Deterministic changed-file risk rules
  • Command, health, and browser checks
  • Redacted logs and reports; selected artifacts
  • Workspace access, roles, and runner visibility
Deferred

Not available yet

  • GitHub App and Gitea webhook automation
  • Hosted runners
  • Executable Docker Compose previews
  • AI-written report summaries
  • Billing and paid plans
  • Browser-based .patchproof.yml editing

Preview metadata can be planned today, but PatchProof does not yet boot or proxy Docker Compose previews.

Trust boundary

Coordination in the cloud. Execution on your runner.

PatchProof keeps untrusted repository work outside the control plane while preserving a shared, reviewable proof.

  1. 01

    PatchProof Cloud

    Plans runs, matches runner capabilities, stores structured evidence with redacted logs, and enforces workspace access.

    • No repository execution
    • No Docker socket
    • Scoped orchestration tokens
  2. 02

    Self-hosted runner

    Claims the job, checks out authorized source, executes bounded commands, and redacts output.

    • Per-run workspace
    • Bounded time and logs
    • Customer-controlled network
  3. 03

    Reviewable proof

    Separates execution, risk, and verdict so the merge decision points back to concrete evidence.

    • Deterministic findings
    • Redacted logs, bounded artifacts
    • Commit and policy provenance

A verification loop for coding agents

Generation can be fast. The proof should still be deliberate.

A coding agent can inspect its working-tree diff, run the repository’s declared checks, read the structured verdict, and stop when the proof says the patch is risky or blocked.

  1. Patch

    Make a bounded change in an authorized checkout.

  2. Verify

    Run deterministic checks and risk analysis.

  3. Read

    Use the verdict and top concerns as the next instruction.

  4. Refine

    Fix, rerun, and preserve the final proof.

See the agent workflow
Authorized project checkout shell 
node /path/to/authorized/patchproof-source/apps/runner/dist/cli/index.js run \
  --base origin/main \
  --head HEAD

# Inspect the saved, redacted proof
node /path/to/authorized/patchproof-source/apps/runner/dist/cli/index.js report --latest

Quickstart

Create a local proof from source.

PatchProof is not published as a public package. Early-access users start from an authorized source checkout with Node.js 22 or newer.

Read the complete Quickstart
PatchProof source checkout shell 
node --version
npm ci
npm run build

node apps/runner/dist/cli/index.js --help

Early access

Make the next merge decision from evidence.

Create a workspace for the manual-first PatchProof 0.1 experience, or review the source-based Quickstart before you begin.

Create your workspace Read the Quickstart