VibeShift — AI Code Integrity Gate

The Problem AI coding tools like Cursor, Copilot, Devin, and Windsurf generate code fast — but they don't understand a team's architecture. They put database logic inside UI components, import npm packages that don't exist (AI hallucination), introduce SQL injection and hardcoded secrets, skip unit tests, bypass shared utilities, and leave TODO stubs as coverage. Every AI-generated pull request is a potential architectural drift event, and without a gate, these issues merge silently into production. The Solution VibeShift is a live PR integrity gate for AI-assisted development teams. It connects to a developer's real GitHub account via OAuth, learns the repository's "Project DNA" by reading ARCHITECTURE.md, CONTRIBUTING.md, and .vibeshift.yml (falling back to 8 universal OWASP rules if none exist), and deploys four parallel IBM Bob 2.0 subagents to inspect every changed file the moment a PR is opened. The Pattern Drift Agent checks 8 architecture/convention rules (e.g., no DB clients inside UI components, no direct axios calls bypassing shared API clients). The Security Sentinel Agent runs 9 OWASP/CWE-mapped SAST checks (SQL injection, hardcoded secrets, eval, XSS, open redirects). The Dependency Guardian Agent cross-references every import against a 30+ package whitelist to catch AI-hallucinated npm packages before they break a build. The Test Gap Finder Agent flags new source files shipped with no corresponding tests, or test files that are just skipped stubs. Results are combined into a single integrity score (100 − critical×20 − high×10 − medium×3 − low×1) and a Go/No-Go decision. VibeShift then posts directly back to GitHub: a commit status check, a detailed PR comment with per-line violations, and — if the score falls below 60 or any critical issue is found — a merge block via branch protection. Target Users & Interaction Engineering teams adopting AI pair-programming tools are the primary users. They interact with VibeShift two ways: automatically, via a GitHub webhook that fires on every PR open/update (responding in under 100ms, then analyzing in the background); or manually, by signing into the VibeShift dashboard with GitHub and clicking "Analyse" on any open PR. Either way, they get real violations, an integrity score, and a downloadable report — with results also visualized on a live analytics dashboard (score trends, violation breakdowns, agent execution times). What Makes It Unique Unlike generic linters, VibeShift operates on real GitHub OAuth data — not mock demos — and learns each repository's own specific conventions instead of applying one-size-fits-all rules. Its four-agent parallel architecture lets it reason about architecture, security, dependencies, and test coverage simultaneously, addressing the exact failure modes unique to AI-generated code that traditional static analysis tools miss.