BobSpot — Evidence-Backed PR Verification

AI coding assistants can review pull requests fast, but their findings aren't always correct. A reviewer might flag "this allows an expired coupon to be accepted" — but is that true? Can it be reproduced? Does the fix actually work, or did it break something else? Today, developers still have to manually investigate every AI claim before they can trust it. That manual verification step is the real bottleneck. BobSpot removes it. Instead of treating an AI review comment as fact, we built a pipeline of specialized IBM Bob agents that investigate, reproduce, fix, challenge, and verify every finding — and nothing is marked a bug until there's executable evidence. The workflow: a developer submits a GitHub repo and PR number. A Context Agent reads the PR description, issue, and README to understand intended behavior. An Investigator Agent scans the diff for candidate issues. A Reproducer Agent writes and runs a real test to confirm or disprove each claim — if it can't reproduce the bug, the finding is REJECTED right there, no matter how confident the original claim sounded. Only reproduced bugs move forward: a Fixer Agent writes a minimal patch, an Adversarial Verifier actively tries to break that patch with edge cases (null values, timezone boundaries, boundary conditions), and a Regression Agent re-runs the full existing test suite to catch collateral damage. Every finding ends in one of five states — PROVEN, PROVEN FIXED, REJECTED, UNVERIFIED, or FIX FAILED — each backed by a visible trail of evidence, not just an agent's opinion. This matters because agreement between AI agents isn't proof. Multiple models can confidently repeat the same wrong assumption. BobSpot's core principle is that execution evidence outranks agent consensus — if five agents agree a bug exists but the reproduction test can't trigger it, the finding is rejected, full stop. Target users are developers, tech leads, and QA engineers who are already relying on AI-assisted review and need to know which findings are worth their time — and reviewers who want confidence before merging, not just another opinion to weigh. In the dashboard, a developer sees live agent status as verification runs (Investigator → Reproducer → Fixer → Adversarial Verifier → Regression), a findings list filterable by status and severity, and — for each finding — a full proof trail: the claim, the flagged code, the reproduction test and its before/after result, the proposed diff, every adversarial edge case checked, and the regression suite outcome. Rejected findings show exactly why the original claim was wrong, and failed fixes are flagged for human review rather than silently merged. What makes this creative and different from existing multi-agent reviewers is that we don't stop at "more agents reviewing the code" — we make the agents prove their own findings against real execution, and we make agents adversarial toward each other's work rather than cooperative toward a shared conclusion. It turns AI code review from an opinion developers have to double-check into a reproducible, auditable proof.