Skip to content
chinwag THE CRYPTO OS FOR GIT

CI/CD Instant Remediation

Chinwag secures your CI/CD and saves 360 developer minutes every 100 builds.

✓ CI/CD Instant Remediation · 50 credits per failed CI run. Claim 500 free credits & reserve a pack →

Every engineering team today runs AI coding agents alongside human developers. Yet when a CI build fails on main or a pull request, the pipeline still dumps four thousand lines of raw output into a webhook and waits twenty minutes for a human to hunt the log, copy the stack trace, and paste it back into an IDE.

Markdown instruction files like CLAUDE.md and AGENTS.md cannot fix this because they are only suggestions inside a prompt. They cannot authenticate which agent broke the build, cannot enforce repository policy before code merges, and cannot route a failure back to the responsible agent without opening inbound webhook ports.

Chinwag replaces webhook noise with cryptographic policy enforcement and direct-to-agent CI remediation.

How CI/CD instant remediation works

When a CI run fails, Chinwag resolves it in twelve deterministic steps:

  1. 1Pushing. @AI-DEV1 pushes signed branch feat/auth-jwt (9f3a1c2) to PR #418, triggering CI/CD Run #418 while local main stays untouched.
  2. 2Verifying. Before running build code, chinwag-ci verifies @AI-DEV1’s ✓ed25519 signature on 9f3a1c2 against .chinwag/allowed_signers.
  3. 3Building. GitHub Actions compiles 9f3a1c2 and runs cargo test --workspace across 6 parallel shards.
  4. 4Failed. Run #418 fails on auth::jwt::verify_clock_skew (src/jwt.rs:142, exit 101) — and because Step 2 authenticated the signer, Chinwag already knows @AI-DEV1 owns the broken commit.
  5. 5Packaging. Before Run #418 exits, chinwag-ci scrubs secrets and seals the failing trace into a signed HPKE .cwcard.
  6. 6Routing. The Chinwag 'c' Blind Relay routes the sealed failure card over outbound port :443 (0 inbound webhooks, 0 payload inspection).
  7. 7Waking. The local Chinwag daemon verifies the failure card and wakes @AI-DEV1 inside an isolated copy-on-write Jujutsu (jj) sandbox (main untouched).
  8. 8Fixing. @AI-DEV1 patches the bug in isolation, commits candidate 4d8e91b (+14/-3 LOC), and passes local WP-04 policy checks.
  9. 9Pushing. @AI-DEV1 pushes signed candidate 4d8e91b back to PR #418 alongside bound ✓ed25519 + WP-04 policy evidence.
  10. 10Verifying. Fresh CI/CD Run #419 verifies accepted signer @AI-DEV1 (using ✓ed25519 signature), exact revision 4d8e91b, and WP-04 policy evidence before compiling.
  11. 11Building. CI/CD Run #419 builds verified candidate 4d8e91b and re-runs all 148 test specs.
  12. 12Passed. Run #419 passes (148/148 green) and marks PR #418 merge-ready in the same Slack thread.
50 credits / failed CI run 
# .github/workflows/ci.yml · 1-line runner wrapper, zero inbound webhooks
- name: Run tests with Chinwag instant remediation
  uses: emunlabs/chinwag-ci@v1
  with:
    org: acme-corp
    mode: wrap
    command: cargo test --workspace --all-targets

Read the docs (docs.chinwag.sh) ↗ · View Apache 2.0 source on GitHub (emunlabs/chinwag) ↗

Under the hood

Every CI wakeup and candidate patch is signed with the agent seat’s Ed25519 key and verified against your repository’s .chinwag/allowed_signers file. Because agents work inside colocated Jujutsu (jj) sandboxes pinned to the failing commit, your human developer can keep typing and switching branches in their IDE without interruption and without ever having to learn Jujutsu.

PAIR PROGRAMMING → Cross-Model Pair Programming Pair independent AI model families in isolated Jujutsu sandboxes so no agent ever grades its own homework. AUTONOMOUS DELIVERY → Autonomous AI Delivery & Board Sync Move a card on GitHub or Linear. Code, docs, website, and QA ship together—or snap back in 200ms. BLIND RELAY & CRYPTO → Outbound-Only Blind Relay & Policy Gate Zero inbound ports, HPKE end-to-end encryption, Ed25519 signatures, and an immutable audit log.