.png&w=256&q=75)
🤓 Latest Submissions
.png&w=828&q=75)
Session Doctor
PROBLEM FastAPI + async SQLAlchemy apps routinely break one rule: a transaction should have exactly one owner. The resulting bugs are easy to write and hard to see. On FastAPI 0.118+, a commit after `yield` in a dependency runs after the response is sent, so a failed write still returns 201 and the data is silently lost. Helpers that commit on their own leave partial writes when later validation fails. Lazy-loaded relationships crash with MissingGreenlet. One session shared across asyncio.gather or create_task leaks pooled connections, and a module-level session sits "idle in transaction", blocking migrations. Several of these never error at the endpoint that causes them, so reading logs doesn't find them, and nothing tells you when you've fixed them all. We measured this. On a FastAPI + Postgres storefront with 8 planted session bugs and 2 decoys (correct code that looks suspicious), IBM Bob asked to "find and fix the session problems" fixed 5/8. Pushed a second time, it reached 7/8, and one bug (a shared session in asyncio.gather) survived. Bob can fix these bugs once pointed at them; the hard part is knowing they exist and knowing when you're done. SOLUTION Session Doctor supplies the work list and the stopping condition: 1. Scan: a deterministic Python AST scanner builds a session-ownership graph (where each session is created, passed, committed and closed) and applies 8 rules: commit-after-yield, helper-commits, read-after-commit, lazy-relationship, begin-after-autobegin, shared-session-concurrency, unsafe-background-work, session-outlives-request. 2. Prove and fix: an IBM Bob custom mode and skill take the scanner report as the work list, reproduce each symptom, and refactor to the one-owner pattern (helpers flush, the route commits once before returning). Done means the scanner reports zero high findings and tests pass. 3. Guard: a GitHub Action runs the scanner on every pull request with no LLM and no credits, and Bob workspace rules keep new Bob-written code on the convention. RESULTS On the untouched fixture the scanner reports exactly 8 high findings, one per planted bug, with zero decoys flagged. The 10 hidden end-to-end tests agree: 8 fail, 2 pass. On the reference fix the scanner reports 0 high findings and all 10 tests pass. The scanner's verdict matched runtime behaviour on both versions. The answer key, hidden tests and reference fix are in the repo under eval/ so judges can reproduce this. TARGET USERS Backend teams on FastAPI + async SQLAlchemy, and teams using AI coding assistants who need a way to verify that generated database code is actually correct. WHAT'S DIFFERENT Existing linters check individual lines or model style, and runtime tools catch N+1 queries. Session Doctor models session ownership across functions and files, and pairs cheap deterministic detection for CI with Bob for the reasoning-heavy fix. LIMITATIONS Static analysis of common patterns, evaluated on one fixture built for this project. A full Bob fix run guided by Session Doctor was not completed because the hackathon Bobcoin budget ran out.
27 Sep 2026
