Under the hood
justfixit.AI is an autonomous repair agent with a 3-layer safety pipeline, multi-model AI consensus, Sigstore-verified fix packages, and OS-level snapshots. Here's how it all works.
Architecture
Enterprise-grade safety meets AI autonomy
Multi-Model AI Consensus
Claude Sonnet 4.5, Gemini 2.0, and open-source models (Qwen 3.5, Phi-4) independently diagnose the same problem. Execution requires consensus.
Sigstore Verified
Every fix package is signed via Sigstore (keyless OIDC + Fulcio CA + Rekor transparency log). Tampered packages are rejected at execution time.
JFX Declarative DSL
Custom fix language — declarative, auditable, cross-platform. GBNF grammar-constrained generation. Mandatory rollback blocks. Not bash scripts.
MCP Protocol Native
Model Context Protocol for all agent integration. Any AI agent (Claude, GPT, Gemini, local LLMs) plugs in via MCP tools. No vendor lock-in.
3-Layer Safety Pipeline
Pattern analysis (<1ms) → AST analysis (<10ms) → LLM semantic analysis (<2s). All three must PASS before any command executes. No exceptions.
Local-First Intelligence
Qwen 3.5 Small (9B) runs on your machine for fast, private diagnostics. Cloud LLMs only for hard problems. Your data stays local.
Provider-Agnostic Router
10 LLM providers via unified interface. Capability-based routing: quality_first, cost_optimized, speed_first, local_first. Circuit breaker + budget enforcement.
OS-Level Snapshots
APFS snapshots (macOS), VSS (Windows), LVM/Btrfs (Linux) before every fix. Real restore points — not file copies. Verified restorable before proceeding.
End to end
The repair pipeline
- 1
Connection
Secure WebSocket connection established with end-to-end encryption between local agent and cloud API.
- 2
Analysis
Multi-model AI consensus (Claude, Gemini, open-source fallbacks) analyzes system logs, processes, and configuration.
- 3
Solution Match
AI matches the diagnosis against the certified fix repository — Tier 1 vendor-signed packages first, then community-scored, then AI-generated.
- 4
Execution
Local Rust agent executes the verified JFX package after OS-level snapshot, with your explicit consent recorded in audit trail.
- 5
Verification
Post-fix health check compares before/after system state. Outcome data feeds the learning pipeline. 7-day regression monitoring.
Security first
Security architecture
Vendor-Approved Code
Tier 1 fixes are X.509 signed by vendors and co-signed by the platform. Verified via Sigstore before execution.
Cryptographic Verification
Every JFX package verified against KMS-held public keys. Tampered packages are rejected at the boundary.
Sandboxed Testing
Community and AI-generated fixes execute in isolated sandbox VMs before being offered to users.
Transparent Audit
Every fix produces a proof-of-work audit log: snapshot timestamp, AI reasoning, consensus vote, health delta.
Trust Model
Fix Repository Trust Tiers
Vendor Certified
Vendor X.509 signed + platform co-signed. Auto-executes.
Community
Quarantine → AI scan → sandbox → community scoring (Bronze → Platinum).
AI Generated
Always requires explicit consent. Full safety pipeline. Sandbox VM first. Labeled experimental.
CLI Preview
What it looks like under the hood
Technology
The full stack
Cloud AI
Claude Sonnet 4.5, Gemini 2.0 Flash, Llama 3.3, DeepSeek V3.2, Groq, Mistral
Local AI
Qwen 3.5 Small 9B, Phi-4 14B, Qwen 2.5-Coder (GBNF constrained)
Agent
Rust (edition 2024), Tauri, llama-cpp-2, tokio async runtime
Protocol
MCP (Model Context Protocol), MCP Elicitation for consent
Security
Sigstore, Fulcio CA, Rekor transparency log, TUF metadata
Cloud
GCP (Cloud Run, Firestore, Pub/Sub, KMS), Firebase Auth
Frontend
React, Vite, Tailwind CSS, framer-motion
Observability
OpenTelemetry, Sentry, GCP Cloud Ops, PagerDuty
Compliance
Standards Alignment
justfixit.AI aligns with established security and diagnostic standards, not because we have to, but because autonomous repair demands it.
SCAP / OVAL
JFX diagnostic packages align with SCAP (Security Content Automation Protocol) and OVAL (Open Vulnerability and Assessment Language). Structured detection definitions, not ad-hoc scripts. Machine-readable, auditable, and interoperable.
NIST AI RMF
Our AI agent design follows the NIST AI Risk Management Framework. Risk identification (3-layer safety pipeline), measurement (outcome telemetry), mitigation (snapshot + rollback), and governance (trust tiers + audit logs) are all built in.
OWASP Agentic Top 10
Addresses all 10 risks from the OWASP Agentic AI Top 10: prompt injection defense (constrained JFX grammar), tool misuse prevention (command allowlist), excessive permissions (least-privilege execution), and more.
JFX Spec
Two package types: JFX-Diagnostic (detection intelligence using Sigma-compatible rules + osquery SQL) and JFX-Fix (certified remediation with mandatory rollback blocks). Both cryptographically signed, community-contributable, and GBNF grammar-constrained.
ISO 27001 / SOC 2
Designing for ISO 27001 and SOC 2 Type II from day one. All infrastructure runs on certified GCP services. Zero PII in telemetry, AES-256-GCM encryption at rest, TLS 1.3 in transit, full audit trails.
Safety Pipeline
Three mandatory layers before any command executes: L1 pattern matching (<1ms, regex + blocklist), L2 AST + blast radius analysis (<10ms, static analysis), L3 LLM semantic review (<2s, intent verification). All three must PASS. No bypasses.
Contribute
Open source at heart
justfixit.AI's signing framework, JFX language, and SDK are open source. Contributors earn revenue share by submitting certified fixes through the community portal.
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18
7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU
Contributions support open-source development