# Patch Agent

> An autonomous defensive agent that watches critical software disclosures, identifies affected opted-in open-source projects, generates defensive fixes and proves every patch publicly.

## Purpose
Reduce the time between a public vulnerability disclosure and a tested fix in open-source repositories that have explicitly opted in.

## What it does
- Ingests advisories from NVD, GitHub Security Advisories and CISA KEV, keeping provenance (provider, record id, URL, retrieval time, raw hash).
- Matches pinned PHP runtime versions in Dockerfiles, compose files, CI workflows and composer.json config.platform.
- Generates deterministic version-bump patches; validates them against a file allowlist, diff-size limit, secret and dangerous-content checks.
- Opens a pull request on a new branch only when the repository installed the GitHub App and its .patchbot policy permits it.
- Publishes REAL actions with external verification URLs at /proof.

## What it does NOT do
- No exploit, payload or proof-of-concept generation.
- No scanning of arbitrary hosts, URLs or private systems.
- No pull requests to repositories that have not opted in. No pushes to default branches.
- No private keys are held by the website.

## Operational status (computed 2026-10-22T11:05:31.377Z)
Overall: degraded
Demo mode: false
GitHub writes enabled: true
Live treasury: true
Durable persistence: true
Real patches recorded: 6
- CVE ingestion (NVD): unavailable
- GitHub reader (advisories API): operational
- CISA KEV feed: operational
- PHP release index: operational
- Repository matcher: operational
- Patch generator: operational
- Orchestration worker: degraded
- CI verifier: operational
- GitHub App: operational
- GitHub writer: operational
- Treasury RPC: operational
- Realtime stream (SSE): operational
- Database (Postgres): operational
- Isolated test runner: not_configured

## Evidence
- Status (JSON): https://phpagent.si/status.json
- Project (JSON): https://phpagent.si/project.json
- Proof ledger: https://phpagent.si/proof and https://phpagent.si/api/v1/proof
- OpenAPI: https://phpagent.si/openapi.json
- Methodology: https://phpagent.si/methodology
- Sources: https://phpagent.si/sources
- Whitepaper: https://phpagent.si/whitepaper
- Security: https://phpagent.si/security

## Data labelling
Records carry dataMode REAL or DEMO. DEMO records are produced only when the server runs with DEMO_MODE=true and are never included in /api/v1/proof.
PHP2Shell facts (CVE-2026-109618, CVE-2026-109619, fixed releases): VERIFIED against NVD and php.net; see https://phpagent.si/sources. Third-party research write-ups are not cited until confirmed.

## Contact


Version 0.1.0, deployment 6c0de23.