DREW

#Principles

1. DREW is a coding agent — use the harness, don't rebuild it#
   Remediation means cloning a repo, editing manifests, building, and fixing the breakage a bump introduces — which is the Claude Code loop; rebuilding it on the raw SDK would be reimplementing Claude Code badly. → §2a, §2b
2. Automating PRs without automating review just moves the bottleneck#
   The deliverable is the full path to merge; trunk safety comes from a bounded, revertable change class plus CI + a deterministic verifier, and the Adjudicator track exists to satisfy any required human review. → §2g, §2e, §2d
3. Throttled, ephemeral, auditable#
   One open PR at a time, highest-severity first; each run is a fresh hard-killable container with full transcript to #drew-audit + S3; trust is earned in phases. → §2c, §1

#TODO 1 / 12 done

• 1
  Supervisor — poll, rank, throttle, guards#

  Polls the Dependabot alerts API, ranks highest-severity-first, enforces the open-PR throttle, dedups, and spawns one worker; prototype is the local CLI authenticating as the ax-drew App, with the prod daemon posture (scheduled polling, Redis guards, Secrets Manager, Slack + S3 trail) still to land.

  awaiting sign-off prod daemon posture — scheduled supervisor, Redis guards, Secrets Manager, #drew-audit + S3 trail

  #2300 feat(drew): Dependabot remediation prototype
• 2
  Worker cage + egress jail + harness wiring#

  Disposable container running claude -p with a constrained tool surface, its only network route the default-deny iron-proxy egress jail; prototype ships the hardened container and mandatory jail in warn mode, with enforce-mode and credential-swap still to land. → §2e

  awaiting sign-off egress jail flipped warn → enforce after a clean remediation

  awaiting sign-off credential-swap live — worker holds only opaque proxy tokens for GitHub + Anthropic

  #2300 feat(drew): Dependabot remediation prototype
• Remediation engine — bump + build + fix, dry-run#

  Given one alert, the worker resolves the patched version, bumps the manifest/lockfile, builds, and edits source until it compiles — emitting a diff + build result with nothing pushed. → §2d

  #2300 feat(drew): Dependabot remediation prototype
• 4
  Supervised live runs — operator-triggered, human-gated#

  First live writes: each run is operator-triggered and each merge passes required review; the worker opens a ready PR, arms auto-merge, shepherds CI to green, and exits MERGED | PARKED | BAILED. The live record below is the calibration data; the deterministic out-of-agent verifier must be built and validated against these diffs before phase 5 (§3.6).

  awaiting sign-off deterministic out-of-agent verifier built + validated against the live diffs (no false-passes)

  #2305 chore(deps): bump axios to 1.16.0

  #2306 chore(deps): bump rustls-webpki to 0.103.13

  #2307 build(deps): bump js-cookie to 3.0.7

  #2308 chore(deps): bump uuid to 11.1.1

  #2311 build(deps): bump protocol-buffers-schema to 3.6.1

  #2313 build(deps): bump postcss to 8.5.10

  #2314 build(deps): bump esbuild to 0.25.0

  #2315 build(deps): bump ws to 8.20.1
• 5
  Lights-out — scheduled supervisor, merge on green#

  Unattended operation: scheduled supervisor, merge without a per-PR human — either checks-only branch protection for drew/deps/* or the Adjudicator supplying the review. Lands narrow (lockfile/patch first), widening as the record justifies; requires the phase-1 daemon, phase-2 enforce jail, and phase-4 verifier.

• C1
  Pipeline telemetry — measure before touching#

  Read-only: pull per-job timings, queue waits, and cache hit rates from the Actions API, persist the series, and produce a hotspot ranking. No opinion without data.

• C2
  Optimization PRs — human-merged, coverage-proven#

  Propose pipeline speedups, each carrying before/after timing and a deterministic coverage proof that the test/lint set didn't shrink; every CI change is human-merged since the App lacks Workflows: write (§3.17). → §3.18

• C3
  Regression watchdog — ratchet the wins#

  Alert when main's CI wall-clock regresses, bisect to the commit, and file the issue with evidence — the ratchet that makes this ambient infra.

• A1
  Shadow reviewer — advisory comments, no authority#

  Reviews every DREW PR (correctness, scope, supply-chain) and posts comments only; verdicts are scored against human outcomes to measure the false-pass rate before any authority is requested. → §2g

• A2
  Conservative auto-approve — DREW's bounded class only#

  A separate App (ax-adjudicator) may submit an approving review only when every threshold passes — bounded diff class, verifier passed, CI green, zero findings, calibrated false-pass rate; any doubt → defer. → §3.14

• A3
  Widen — other mechanical PR classes, defer-by-default#

  Extend to other low-blast-radius mechanical classes one at a time, each with its own shadow calibration; human feature work stays out of scope.

• T1
  Incident triage — diagnose & draft a fix (future)#

  Reuses the supervisor/worker/egress/audit stack with read-only senses (incident.io / ClickHouse / Sentry) and a triage pipeline, but inverted: open-ended root cause over untrusted prod logs, so draft-only, human-gated, never auto-merged.

#Design Questions

1. Auth / billing — subscription or metered API key?#
   YesMetered API key. Anthropic's 2026-06-15 change metered subscription headless use at API per-MTok rates, killing the flat-rate edge. The API key then wins on operability, on being a swappable header credential for iron-proxy credential-swap (§2e), and on being ToS-clean with both CLI and Agent SDK. Metered cost means DREW reports its own estimate + realized spend (§3.6).
2. Autonomy — how far does DREW go unsupervised?#
   YesShepherd → auto-merge, earned in stages. DREW opens a ready PR, arms auto-merge, and shepherds CI green. Today (phase 4) two human gates remain (operator trigger, required review); phase 5 removes the trigger and resolves required review via checks-only protection or the Adjudicator (§3.12). Defensible because the class is bounded, CI is the gate, the verifier backstops it, and the throttle caps a bad merge at one git revert.
3. Egress enforcement — harness sandbox, or network-layer proxy?#
   Yesiron-proxy at the container layer is the real boundary (the harness sandbox is hostname-based defense-in-depth). Chosen for default-deny allowlisting, TLS-terminating rules, MCP tools/list filtering, and credential-swap. Built + mandatory in the prototype (py/drew/egress/), in warn mode; allowlist is Anthropic, GitHub, and the registries — flip warn → enforce after a clean run.
4. GitHub credential — fine-grained PAT or a GitHub App?#
   YesGitHub App ax-drew (CARL §3) — built; DREW opens PRs as app/afintech-drew, repo-filtered to architect-xyz/ax. Minimal perms: Contents/Pull requests: write, Checks/Statuses/Actions: read (the shepherd needs the status rollup + failing logs), Dependabot alerts: read, Issues: write, Metadata: read — and not Administration, Workflows, Actions: write, Members, Secrets. Merge is gated by branch protection, not the token (§3.12); withholding Workflows makes Actions-ecosystem bumps out of scope for v1 and constrains the CI/CD track.
5. Ingest mechanism — poll the alerts API, or a webhook?#
   YesPoll the Dependabot alerts API on an interval. Polling needs no inbound endpoint (egress-jail-friendly), is idempotent against the throttle, and a few-minutes lag is irrelevant; the webhook is a later latency optimization.
6. Per-remediation budget — what are the caps?#
   YesMeter + report; wall-clock + attempt cap. DREW logs an up-front estimate and realized per-MTok spend (BARD-style) — reporting, not a hard cap. Runaway guards are time-based: a wall-clock docker kill backstop and a cap on shepherd fix-attempts. A third lever — context-window degradation — starts as a hard-kill at 50% of the window (RULER finds ~50–65% usable), tuned from phase-4 data.
7. Repo working copy — fresh clone per remediation, or a warm cache?#
   YesFresh shallow clone per remediation, destroyed with the container — ephemerality is a security property. git clone --reference is a latency optimization that preserves it. Distinct from the warm CARGO_HOME/target build cache (§2f).
8. Scope — which bumps does DREW take, and in what order?#
   YesWiden by risk class. Unattended merge lands on the safest first — lockfile-only / patch-level bumps (5.1) — then minor, then breaking-change fixes (5.2) as the record earns it. Ecosystem scope is cargo + npm; Actions/workflow bumps are excluded (§3.4). Phase 4 attempts every class since a human approves each merge.
9. Host — Mac mini or EC2 (like BARD)?#
   YesA single Mac mini (M4, 16 GB). EC2 would mirror ax-bard exactly but the Mac mini wins on flat capex (~$799 vs ~$256/mo), M4 build speed, and ownership; EC2 Mac is ruled out. Trade-offs: ops/uptime on us (a physical SPOF) and a Docker-VM-side egress jail. The 16 GB cargo check concern is handled by the one-at-a-time throttle + CI-as-compile-authority (§2f).
10. Prior art — what's worth lifting from CARL & GOPHER?#
    YesMined (§2a). Adopted: alert polling + severity ranking; auto-merge of green bumps; iron-proxy egress + credential-swap + tool-filtering; the container-hardening recipe; the App minimal-permission set + signed commits; the context-window monitor (reframed to 50%); warm cargo/sccache; S3 + #drew-audit; metered-key self-metering; the shared guard/ gate. Promoted: the deterministic verifier (§2d). Dropped: /drew pause. Diverged: the harness, the Mac mini, fixing breaking changes.
11. Target version — the advisory's first patched version, or latest?#
    YesPin to first_patched_version, the minimal bump that clears the advisory. "Latest" maximizes unrelated breaking changes and can pull a newer release with a fresh not-yet-flagged vuln. If the minimal version is yanked or unbuildable, step to the next viable release and note it.
12. Merge gate — how does auto-merge reconcile with branch protection?#
    OpenMerge is whatever branch protection on main allows — no bypass; the worker arms gh pr merge --auto, so where a required human review exists the PR parks until approved (degrading cleanly to supervised). The decision sharpened into the Adjudicator: (a) keep a required reviewer, (b) checks-only protection for drew/deps/*, or (c) let a calibrated bot satisfy the review under conservative thresholds. Start with (a); let A1's shadow record decide between (b) and (c).
13. Native Dependabot PRs — own the lane, or adopt them?#
    OpenGitHub's own security-update PRs would duplicate and race DREW. (a) disable native PRs so DREW is sole remediator on its own drew/deps/* branch, or (b) DREW adopts the existing Dependabot branch. Leaning (a) for a clean ownership boundary; either way DREW reads the same alerts API and the throttle keys on DREW-authored PRs only.
14. Adjudicator identity — can DREW review its own PRs?#
    YesNo — a separate App (ax-adjudicator). GitHub refuses self-approval, so ax-drew can't satisfy a required review on its own PRs; the constraint enforces separation of duties and makes disagreements auditable signal (§2g). Perms: Pull requests: write, Contents/Checks/Statuses/Actions: read — no merge, no workflows.
15. Adjudicator thresholds — what does "very conservative" mean concretely?#
    OpenThe A1 → A2 gate needs numbers. Candidate: auto-approve only when (1) the diff is in a deterministically recognizable mechanical class, (2) the verifier passed, (3) full CI green, (4) the review found zero findings, and (5) the shadow false-pass rate is below target over the recent N ≥ 50 reviews. Open: the value of N, the target rate, calibration staleness, and whether critical-severity bumps always defer.
16. Adjudicator approval — does a bot review satisfy branch protection, and do we want it to?#
    OpenMechanically an App with Pull requests: write can approve and plain "require 1 approval" counts it — but rulesets (Code Owners, restricted reviewers) need auditing first. The policy question is separate: do we want merges gated on a bot approval (c) vs dropping the requirement for the bounded class (b)? Decide after A1 produces a false-pass record.
17. CI/CD lane permissions — who can edit .github/workflows?#
    OpenThe trunk withholds Workflows: write from ax-drew (§3.4), so C2's optimization PRs can't even push a workflow edit. Options: (a) a separate narrowly-granted ax-drew-ci App used only by C2 with every PR human-merged, (b) DREW drafts the diff as an artifact a human applies, or (c) scope C2 to non-workflow speedups only. Leaning (b) to start, (a) if the lane proves out — workflow write shouldn't be quietly reversed.
18. CI/CD coverage invariant — how do we prove "same coverage, faster"?#
    OpenCandidate: a deterministic coverage-set diff — enumerate the executed test set and enabled lint set on main vs the branch and require the diff empty-or-additive as a CI check on every C2 PR. Open: flaky-test quarantine (removing a flaky test is a coverage change), sharding masking order-dependent tests, and whether feature-matrix reductions count as shrinkage (they do).

#Scratchpad

Long-form reference and working notes — mostly write-only, for LLM/agent use. Collapsed by default.

Dependabot alerts API ──(poll)──┐
                                ▼
┌──────────────────────────────────────────────────────────────┐
│  DREW SUPERVISOR  (long-lived Python service)                 │
│   • poll open alerts; rank by severity → CVSS → age           │
│   • THROTTLE: open DREW deps PRs at cap? → wait this cycle     │
│   • Redis: per-alert lock, concurrency gate = 1, timers       │
│   • dedup; spawn ONE worker for the top group                 │
│   • relay PR link + merged/parked/bailed to #drew-audit       │
└───────────────────────────────┬──────────────────────────────┘
                                │ docker run --rm (fresh, jailed)
                                ▼
┌──────────────────────────────────────────────────────────────┐
│  DREW WORKER  (ephemeral container = `claude -p` harness)     │
│   fresh shallow clone @ main                                  │
│   bump → just rs/format → cargo check → fix call-site breakage│
│   verifier → gh pr create → arm auto-merge → /shepherd        │
│   exits DREW_STATUS: MERGED | PARKED | BAILED                 │
│   egress: allowlist proxy (Anthropic · GitHub · crates/npm)   │
└──────────────────────────────────────────────────────────────┘