Nightshift: logs triaged overnight, PR by morning

The problem Every production service writes warnings nobody reads. A log-visible defect costs a senior developer 2–4 hours to handle properly: notice it, grep past the noise, work out which of thousands of lines are the same fault, map a stack frame to a line of code, judge whether it matters, then write and route a fix. So most defects never get that attention. A WARN about a leaking connection pool is free to ignore for six weeks, until the pool runs dry at month-end and the service goes down. Log aggregators stop at the dashboard. They alert. They do not fix. The solution Nightshift is a scheduled agentic pipeline for backend teams. It runs overnight over a rolling 7-day log folder and does the whole loop: 1. Reads only new bytes. Every file has a Postgres checkpoint, so nothing is re-read or double-counted. 2. Fingerprints warnings and errors into distinct incidents. The same NullPointerException thrown from two services collapses into one incident. 3. A triage agent diagnoses each incident. It assigns severity by frequency, trend and blast radius rather than log level, identifies the root cause, and forecasts the damage if the incident is left alone. 4. Maps the stack trace to the exact file and line in the target repository. 5. A fix agent proposes a minimal change. Nightshift computes the diff itself, so hunk line numbers are always correct. A patch guard enforces size limits, protected paths and balanced brackets. 6. An adversarial verifier agent tries to reject the patch. If it does, its objections go back to the fix agent for one revision. 7. Opens one pull request per incident with the severity, root cause, forecast, redacted log evidence, patch and test plan. Then it emails the owning developer through a transactional outbox. It never merges and never pushes to main. A human always decides. How users interact Developers open the pull requests in the morning. Team leads use the web dashboard to see scan runs, incidents with their severity chips, and a full trajectory of every model and tool step. Any MCP client can query incidents through the built-in MCP server. It runs with no API key on an offline heuristic engine, or with OpenAI, Gemini or Anthropic. Why it's different The model is used in exactly three places: triage, patch and verify. Everything else is deterministic code, because it is cheap, exact and testable: reading bytes, parsing, fingerprinting, resolving stack frames, building diffs, branching and pushing. That split makes the agent auditable. Every step is recorded, every patch is checked against the real file before a human sees it, and a second agent argues against the first. Results on the demo dataset (7 days, 3 services, 8 seeded defects): 20,127 lines became 7 incidents and 5 pull requests. Two findings were correctly suppressed: one already handled by bounded retry, one framework noise. That's 2,875 log lines per actionable incident card, with every seeded defect found and no spurious PRs.