BobPulse

THE PROBLEM Modernising legacy code is not hard because the fix is hard to write. It is hard because the fix is hard to trust. A team facing a Python 2 service with SQL injection, MD5 password hashing and a removed HTTP library has three separate problems. First, finding everything: text search misses defects that only exist structurally, such as a query assembled in one statement and executed in another. Second, fixing without breaking: manual refactors introduce regressions, and a reviewer has no cheap way to tell a real fix from a plausible-looking one. Third, and worst, trusting the tooling: AI code generators emit rewrites with no evidence. "Here is your modernised file" is not a claim anyone can verify, and a confidently wrong tool is more dangerous than no tool. THE SOLUTION BobPulse is a scanner and remediation engine with one governing constraint: it must not be able to overstate what it did. 1. Line-accurate scanning. 33 rules across Python, Java, JavaScript, TypeScript, Go and PHP. Python defects are found with a real AST — SQL injection detection follows a query through an intermediate variable to the cursor. Python 2 files are normalised first so they still parse. Comment bodies are blanked before matching, so a file that merely mentions urllib2 in a note is not reported as importing it. 2. Rewriting. With IBM watsonx credentials, synthesis runs through IBM Granite. Without them, a deterministic source-to-source transformer runs. Either way the result is treated as a candidate, not an answer. 3. Verification that can fail. The output is compiled, re-scanned, and run against a generated pytest harness containing one assertion per original finding, executed in a real subprocess. Those assertions genuinely fail when a fix did not land. 4. A retry loop. A rejected candidate is sent back to the model with the verifier's specific complaint attached. If no attempt survives, BobPulse returns the original source unchanged and says so. 5. Measured reporting. Residual technical debt comes from re-scanning the generated code. A rewrite that fixes nothing reports 0%. Anything the rewrite breaks is reported as newly introduced. TARGET USERS AND INTERACTION Backend and platform engineers inheriting unfamiliar code, and reviewers who need evidence rather than assurances. Users paste a file or load an example, press Analyse, and watch five stages stream live. They get a side-by-side diff, findings with line numbers and snippets, a severity-ordered plan annotated with what was actually achieved, verification results, and a pull-request body generated from the measurements. WHAT MAKES IT DIFFERENT Most AI code tools report success. BobPulse reports partial failure when that is the truth. On the bundled examples it resolves 5 of 5 Java findings, 4 of 4 PHP, 2 of 2 Node — but only 6 of 7 Python and 2 of 5 TypeScript, because an SSRF needs to know which hosts are legitimate and replacing "any" needs real types. Those stay open, their assertions stay red, and the plan explains why. Backed by 254 passing tests, including regressions proving unparseable output is rejected and a model failure is surfaced, not swallowed.