CDR: Break it. Let Bob fix it. Prove it survives.

The problem: three silos, nobody closes the loop Resilience work is split across tools that never talk to each other. Chaos engineering (Gremlin, Chaos Mesh) breaks the system, but a human still has to read the code and rewrite it. APM (Datadog, Dynatrace, New Relic) pinpoints a root cause on a dashboard but never touches source code; its only automated lever is adding servers, which hides the defect and raises cloud cost. AI coding agents (Devin, Copilot Workspace) write good code, but they are reactive: they wait for a human to describe a problem, and they have no idea whether the system they edited actually broke. The missing link is: physical collapse -> root cause -> code change -> proof. The research confirms the gap. AIOpsLab (MLSys 2025) found LLM agents diagnose cloud incidents reasonably well but fail systematically at mitigation - its best agent resolved only ~55% of mitigation cases. ChaosEater (ASE 2025) automates chaos experiments but only edits Kubernetes configuration, never business logic. The solution CDR (Chaos-Driven Refactoring) runs the loop autonomously in four phases against a real application: 1. Break it. A k6 scenario drives 200 virtual users through the checkout path of Online Boutique in Docker Compose while Toxiproxy injects 800 ms of latency into the email service mid-run. We capture the physical collapse: p95, p99, error rate, throughput, time-to-collapse. 2. Classify it. Telemetry and logs are mapped to a failure taxonomy (concurrency, memory leak, unresilient dependency, database saturation) with the evidence behind the verdict. 3. Let Bob rewrite it. IBM Bob Shell runs one agent session inside a shallow clone of the target repository, reads the actual service and applies a minimal resilience refactor. The patch we show is the real git diff, not a template. 4. Prove it survives. We git apply the patch, rebuild the patched container and re-run the identical scenario - same VUs, same duration, same fault - then publish the before/after verdict. Measured result (live lab, run-2738beb5): p95 checkout latency 919.6 ms -> 691.1 ms (-24.8%), throughput 122.9 -> 156.4 rps (+27.3%), time-to-collapse 30 s -> no collapse. Bob's fix was two lines in src/checkoutservice/main.go: a 200 ms child context around the optional confirmation-email RPC, so a slow email no longer eats the request budget. Payment and shipping semantics untouched. Cost: 0.083 Bobcoins, 15.9 seconds. Who uses it SRE and DevOps leads at FinTech, e-commerce and streaming companies, where downtime exceeds $300,000 per hour. They paste a repo URL into a dashboard, a worker claims the run, executes the four phases and streams progress back, and the result is an auditable resilience report with the diff and the proof. Why it is creative Every existing tool stops one step short. We are the only ones combining (a) a real telemetry-driven physical collapse, (b) a business-logic rewrite inside the customer's own repository, and (c) autonomous verification by re-injecting the identical fault. A generic agent says "done"; we say "prove it."