INGEST / 01
Idempotent Patch Ingestion
Candidate fixes are pinned to source commits, normalized into deterministic artifacts, hashed, deduplicated and rejected if the same commercial input would produce ambiguous evidence.
PRE-LIVE/verified maintenance infrastructure
Autonomous Open-Source Patch Verification for Enterprise Pipelines
PatchVault turns public upstream fixes into verified, signed delivery capsules. It reproduces the regression, proves the patch changes FAIL into PASS, preserves the evidence, and gates private delivery behind authorization.
3× / 3×
Repeated BASE fail / PATCHED pass trials
SHA-256
Committed evidence and artifact integrity
Sigstore
Keyless CI identity for signed capsules
github-actions / modal / patchvault
$ pv-verify --backend modal --repetitions 3
[github-actions] source checkout pinned to immutable SHA
[github-actions] regression artifact SHA-256 verified
[modal] isolated sandbox created · network restricted during test
[base:1/3] FAIL · fingerprint stable
[base:2/3] FAIL · fingerprint stable
[base:3/3] FAIL · fingerprint stable
[patch] implementation fix applied · hash attested
[patched:1/3] PASS
[patched:2/3] PASS
[patched:3/3] PASS
[evidence] same regression test confirmed across both states
[capsule] manifest hashed · evidence attached · Sigstore bundle verified
verdict: VERIFIED
commercial_state: SELLABLE
delivery_mode: entitlement_required
▮
Core capabilities
Automation with evidence at every boundary.
The system is intentionally strict: ingest once, execute in isolation, and keep commercial communication observable.
EXECUTE / 02
Isolated Execution (Modal)
BASE and PATCHED states run in fresh managed sandboxes. Checkout identity, test integrity, failure fingerprints and repeated PASS results are verified before a capsule can become SELLABLE.
MONITOR / 03
Automated Inbound Monitoring
B2B outreach responses, opt-outs, delivery failures and LIVE-gate signals are monitored automatically. Follow-ups are blocked when a reply or bounce makes further contact inappropriate.
PRE-LIVE CATALOG
One verified resolution capsule. One auditable delivery unit.
Public metadata stays inspectable. The private fix.patch is never exposed before an authorized entitlement. Stripe remains in TEST MODE until the commercial LIVE gate is explicitly approved.
Modal-verified FAIL → PASS evidence
Sigstore-signed manifest
SHA-256 integrity commitments
Entitlement-controlled download