Pasha DevPilot: Autonomous AI Software Engineer

### Problem Statement Modern software engineering teams face immense friction when adopting AI coding assistants. Existing tools typically operate as naive auto-completers or ungrounded chat interfaces: they hallucinate file paths, introduce breaking regressions, lack whole-codebase AST awareness, and make silent modifications without developer consent. Moreover, many platforms demand dangerous Personal Access Tokens (PATs) with sweeping permissions, creating critical security liabilities. ### Our Solution: Pasha DevPilot Pasha DevPilot is a production-grade, autonomous AI software engineering platform engineered as an IBM Bob extension. Driven by IBM Bob (`bob-code-plus`), DevPilot automates the entire Software Development Life Cycle (SDLC) through an audited 7-state pipeline: Understand, Investigate, Plan, Approve, Implement, Verify, and Ship. Instead of guessing code, DevPilot indexes AST symbols across repositories, surfaces genuine architectural and logic defects in a 20-Section Engineering Report, formulates surgical remediation plans, executes tests in an isolated sandbox with bounded self-healing, and serves an interactive Microsoft Monaco Diff Viewer before publishing verified commits and Pull Requests to GitHub. ### Target Users - Software Engineers & DevOps Teams seeking reliable automated bug remediation. - Engineering Managers & Tech Leads requiring human-in-the-loop compliance and zero unapproved code writes. - Open-Source Maintainers triaging issues and automating test-verified dependency and logic fixes. ### User Interaction Workflow 1. Zero-PAT Onboarding: Connect GitHub via secure OAuth 2.0 without ever pasting personal API tokens. 2. Deep AST Codebase Inspection: Select any repository to trigger a deep scan. DevPilot parses symbol trees, shields sensitive files (.env, credentials), and generates a 20-section architectural report. 3. AI Enhancement & Resolve All: Review pinpointed findings or prompt the AI Enhancement Studio ("I want to enhance this repo") to formulate multi-file architectural improvements. 4. Mandatory Human Approval Gate: Inspect the AI-formulated plan detailing root causes, targeted files, and risk levels. Code is never modified without explicit developer authorization. 5. Sandboxed Implementation & Self-Healing: The agent applies surgical diffs in an isolated sandbox, executing pytest suites. If a test fails, a bounded self-healing loop diagnoses tracebacks and repairs the patch (capped at 3 attempts). 6. Monaco Diff Review & 1-Click Push: Inspect syntax-highlighted additions (green) and deletions (red) in side-by-side Monaco Diff Viewer, then click "Commit & Push to GitHub" to publish branches and PRs. ### Creative & Unique Innovations - Strict Human Gate: Absolute zero unapproved writes; guarantees developer control. - Subprocess Execution Sandbox: Whitelists safe test binaries while blocking destructive commands (rm, force push). - Truthful Git Publishing: Direct branch creation, conventional commit generation, and real GitHub PR linking.