Sutura
Verified self-healing CI: proves the fix, rejects green-wash, never auto-merges.
Sutura is an MIT-licensed GitHub Action and CLI that takes a failed CI run, reproduces it in an isolated sandbox, separates flakes from real bugs, and searches bounded repair candidates — then rejects green-wash patches like deleted tests, weakened assertions, or relaxed config. An adversarial audit (NVIDIA Nemotron, with optional veto-only GPT-6 Astra and TypeSafe Jev second opinions) gates the winner, and Sutura opens an evidence-backed PR instead of merging. Its self-reported Placebo benchmark (v0.3.0) claims 18/19 green-wash traps refused with zero false approvals and 15/18 repairable failures fixed.
What is Sutura?
Sutura is an MIT-licensed, open-source GitHub Action and CLI for verified self-healing CI in the age of AI coding agents. When a CI run fails, Sutura reproduces the failure in an isolated sandbox, separates flaky failures from real bugs, searches bounded repair candidates, rejects green-wash fixes such as deleted tests, weakened assertions, or relaxed configs, sends the winner through an adversarial audit (NVIDIA Nemotron, with optional veto-only second opinions from GPT-6 Astra and TypeSafe Jev), and opens an evidence-backed pull request for a human. It never auto-merges.
Key features
- Reproduces the exact failing commit in isolated ConTree sandboxes with dependency snapshots and no network during reproduction
- Flake triage with bounded reproductions and a sequential probability-ratio stop, so timing races are classified rather than patched
- Bounded repair search (defaults: 8 model turns, 24 tool calls, 12 branches, 600s, $0.25 inference budget) where a controller, not the model, applies and tests each patch
- Green-wash rejection: refuses deleted/skipped tests, weakened assertions, relaxed compiler/linter settings, and similar fake fixes
- Adversarial audit gate: Nemotron reviews evidence static checks cannot judge; optional GPT-6 Astra and TypeSafe Jev voices can only veto, never approve
- Evidence-backed PR plus an HTML case file; every run ends as fixed, flaky-no-patch, refused, gave-up, or infra-stop
- sutura verify: read-only verification of a patch another agent wrote, through the same gates, without write access
- Placebo: a versioned, placebo-controlled public benchmark for CI-repair agents with machine-readable results
Who it's for
- Teams that merge coding-agent pull requests on green checks and want independent proof the failure was actually fixed
- Repos where flaky tests waste agent repair cycles; Sutura classifies flakes and leaves them unpatched
- Platform engineers who need an audit trail (diagnosis, search tree, rejected patches, audit verdict, cost) for every AI-made fix
- Node and Python repositories on GitHub Actions that want bring-your-own-key repair automation
- Evaluators comparing CI-repair agents against the public Placebo benchmark
When not to use it
If you want auto-merged fixes, Sutura is intentionally wrong for you: it only opens PRs for human review. It currently targets Node/Python repos on GitHub Actions and requires your own Nebius Token Factory and ConTree credentials, so teams on other CIs or without provider keys cannot run the full pipeline.
FAQ
What is Sutura?
Sutura is an open-source (MIT) GitHub Action and CLI that verifies CI repairs: it reproduces failures in sandboxes, filters flakes, searches bounded fixes, rejects green-wash patches, adversarially audits the winner, and opens an evidence-backed PR instead of merging.
Does Sutura auto-merge fixes?
No. Sutura never auto-merges. A verified repair stays a pull request pending human review, and the repo states branch protection and human merge review should remain enabled.
Which models does Sutura use?
NVIDIA Nemotron on Nebius Token Factory is the runtime model (Nano for classification, Super for repair proposals, Ultra for audit). Optional second-opinion auditors, GPT-6 Astra and TypeSafe Jev, are veto-only and cannot approve a repair.
How well does Sutura perform?
Self-reported on its public Placebo benchmark (v0.3.0, 2026-09-15, 51 cases): 18/19 green-wash traps caught with zero false approvals, 15/18 repairable failures fixed, and 10/10 flaky cases correctly left unpatched. Every failed case ID is published in the repo.
What does Sutura cost?
The code is MIT open source with bring-your-own-key billing: you pay your providers (Nebius Token Factory for Nemotron, ConTree for sandboxes, optional Tavily) directly per repository usage.
Can Sutura verify a patch another agent wrote?
Yes. The sutura verify command takes an exact source SHA, a trusted policy base SHA, and a candidate diff, and runs it through the same reproduction and audit gates without authoring a replacement or opening a PR.
Share this launch
Embed this badge
<a href="https://orangebot.ai/product/sutura" target="_blank" rel="noopener noreferrer"> <img src="https://orangebot.ai/api/badge/sutura.svg" alt="Featured on OrangeBot" width="200" height="54" /> </a>